High level conclusions

Fuzzers reach 62.60% code coverage.

Fuzzers reach 58.53% of cyclomatic complexity.

Fuzzers reach 48.83% of all functions.

Fuzzer flate_fuzzer is blocked:

The runtime code coverage of flate_fuzzer covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1741 / 3565

Cyclomatic complexity statically reachable by fuzzers

21172 / 36167

Runtime code coverage of functions

2232 / 3565

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.5%
gold	[1:9]	10	20.8%
yellow	[10:29]	7	14.5%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	22	45.8%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	42	FuzzHelper::run()	call site: 00042
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

16

Reachable functions

45

Percentage of reachable functions covered

64.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	269	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	269	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
268	0	EP	call site: 00000	deflate

Runtime coverage analysis

Covered functions

1

Functions that are reachable but not covered

184

Reachable functions

184

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	9
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1

Fuzzer: future_ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.5%
gold	[1:9]	5	10.4%
yellow	[10:29]	12	25.0%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	22	45.8%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	42	FuzzHelper::run()	call site: 00042
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

16

Reachable functions

45

Percentage of reachable functions covered

64.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: future_runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	45	45.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	5.10%
greenyellow	[30:49]	5	5.10%
lawngreen	50+	43	43.8%
All colors	98	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	21	qpdf::global::Options::fuzz_mode(bool)	call site: 00021	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
12	58	FuzzHelper::run()	call site: 00058
11	39	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00039	__cxa_allocate_exception
2	78	FuzzHelper::run()	call site: 00078
1	5	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00005
1	55	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00055
1	96	FuzzHelper::run()	call site: 00096	__cxa_begin_catch

Runtime coverage analysis

Covered functions

38

Functions that are reachable but not covered

45

Reachable functions

107

Percentage of reachable functions covered

57.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	10
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/Pl_RunLength.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	49.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	50.5%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	35	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00035	__cxa_allocate_exception
10	50	BitStream::getBitsSigned(unsigned long)	call site: 00050	__cxa_allocate_exception
5	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
5	63	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00063	__cxa_allocate_exception
2	82	Pl_Discard::~Pl_Discard()	call site: 00082	__clang_call_terminate
1	69	Pl_TIFFPredictor::processRow()	call site: 00069
1	77	FuzzHelper::run()	call site: 00077	__cxa_end_catch

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

30

Reachable functions

92

Percentage of reachable functions covered

67.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	165	61.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	38.6%
All colors	269	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	200	deflate	call site: 00200	inflate
17	21	qpdf::global::Options::fuzz_mode(bool)	call site: 00021	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
15	129	deflate	call site: 00129	crc32
13	87	deflateResetKeep	call site: 00087	crc32_z
11	39	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00039	__cxa_allocate_exception
11	186	deflate	call site: 00186	_tr_flush_block
8	56	unsigned long QIntC::to_size (unsigned int const&)	call site: 00056	__cxa_allocate_exception
8	106	deflateReset	call site: 00106	inflateInit_
7	251	Pl_Flate::finish()	call site: 00251	__cxa_begin_catch
6	228	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00228	__cxa_allocate_exception
6	238	FuzzHelper::run()	call site: 00238	__cxa_allocate_exception
5	71	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00071	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

86

Functions that are reachable but not covered

77

Reachable functions

184

Percentage of reachable functions covered

58.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	9
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1

Fuzzer: pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	29.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	70.1%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
4	31	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00031
2	54	Pl_Discard::~Pl_Discard()	call site: 00054	__clang_call_terminate
1	49	FuzzHelper::run()	call site: 00049	__cxa_end_catch

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

16

Reachable functions

73

Percentage of reachable functions covered

78.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	9
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.9%
gold	[1:9]	1	2.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	16.2%
lawngreen	50+	23	62.1%
All colors	37	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	31	FuzzHelper::run()	call site: 00031
1	35	FuzzHelper::run()	call site: 00035	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

15

Reachable functions

42

Percentage of reachable functions covered

64.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.84%
greenyellow	[30:49]	7	9.58%
lawngreen	50+	41	56.1%
All colors	73	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00019	__cxa_allocate_exception
5	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
5	34	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00034	__cxa_allocate_exception
1	40	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00040
1	71	FuzzHelper::run()	call site: 00071	__cxa_begin_catch

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

25

Reachable functions

80

Percentage of reachable functions covered

68.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: future_dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	207	56.7%
gold	[1:9]	1	0.27%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	5	1.36%
lawngreen	50+	151	41.3%
All colors	365	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	135	init_simd	call site: 00135	jinit_forward_dct
32	90	std_huff_tables	call site: 00090	jpeg_start_compress
30	192	unsigned int QIntC::to_uint (int const&)	call site: 00192	jpeg_finish_compress
19	269	master_selection	call site: 00269	jinit_1pass_quantizer
17	22	qpdf::global::Options::fuzz_mode(bool)	call site: 00022	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	40	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00040	__cxa_allocate_exception
11	74	jinit_memory_mgr	call site: 00074	jpeg_set_defaults
9	245	jpeg_core_output_dimensions	call site: 00245	jdiv_round_up
7	237	jpeg_calc_output_dimensions	call site: 00237	jdiv_round_up
3	65	Pl_DCT::finish()	call site: 00065	jpeg_CreateCompress
3	293	jinit_color_deconverter	call site: 00293	jsimd_set_ycc_rgb565
2	346	Pl_DCT::finish()	call site: 00346	jpeg_destroy_compress

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

149

Reachable functions

279

Percentage of reachable functions covered

46.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	8
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_DCT.cc	10
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	207	56.7%
gold	[1:9]	1	0.27%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	5	1.36%
lawngreen	50+	151	41.3%
All colors	365	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	135	init_simd	call site: 00135	jinit_forward_dct
32	90	std_huff_tables	call site: 00090	jpeg_start_compress
30	192	unsigned int QIntC::to_uint (int const&)	call site: 00192	jpeg_finish_compress
19	269	master_selection	call site: 00269	jinit_1pass_quantizer
17	22	qpdf::global::Options::fuzz_mode(bool)	call site: 00022	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	40	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00040	__cxa_allocate_exception
11	74	jinit_memory_mgr	call site: 00074	jpeg_set_defaults
9	245	jpeg_core_output_dimensions	call site: 00245	jdiv_round_up
7	237	jpeg_calc_output_dimensions	call site: 00237	jdiv_round_up
3	65	Pl_DCT::finish()	call site: 00065	jpeg_CreateCompress
3	293	jinit_color_deconverter	call site: 00293	jsimd_set_ycc_rgb565
2	346	Pl_DCT::finish()	call site: 00346	jpeg_destroy_compress

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

149

Reachable functions

279

Percentage of reachable functions covered

46.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	8
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_DCT.cc	10
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.84%
greenyellow	[30:49]	5	6.84%
lawngreen	50+	43	58.9%
All colors	73	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00019	__cxa_allocate_exception
5	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
5	34	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00034	__cxa_allocate_exception
1	40	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00040
1	71	FuzzHelper::run()	call site: 00071	__cxa_begin_catch

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

25

Reachable functions

80

Percentage of reachable functions covered

68.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	45	45.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	5.10%
greenyellow	[30:49]	5	5.10%
lawngreen	50+	43	43.8%
All colors	98	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	21	qpdf::global::Options::fuzz_mode(bool)	call site: 00021	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
12	58	FuzzHelper::run()	call site: 00058
11	39	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00039	__cxa_allocate_exception
2	78	FuzzHelper::run()	call site: 00078
1	5	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00005
1	55	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00055
1	96	FuzzHelper::run()	call site: 00096	__cxa_begin_catch

Runtime coverage analysis

Covered functions

38

Functions that are reachable but not covered

45

Reachable functions

107

Percentage of reachable functions covered

57.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	10
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/Pl_RunLength.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: future_pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	29.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	70.1%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
4	31	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00031
2	54	Pl_Discard::~Pl_Discard()	call site: 00054	__clang_call_terminate
1	49	FuzzHelper::run()	call site: 00049	__cxa_end_catch

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

16

Reachable functions

73

Percentage of reachable functions covered

78.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	9
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: future_tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	49.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	50.5%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	35	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00035	__cxa_allocate_exception
10	50	BitStream::getBitsSigned(unsigned long)	call site: 00050	__cxa_allocate_exception
5	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
5	63	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00063	__cxa_allocate_exception
2	82	Pl_Discard::~Pl_Discard()	call site: 00082	__clang_call_terminate
1	69	Pl_TIFFPredictor::processRow()	call site: 00069
1	77	FuzzHelper::run()	call site: 00077	__cxa_end_catch

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

30

Reachable functions

92

Percentage of reachable functions covered

67.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.9%
gold	[1:9]	1	2.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	16.2%
lawngreen	50+	23	62.1%
All colors	37	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	31	FuzzHelper::run()	call site: 00031
1	35	FuzzHelper::run()	call site: 00035	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

15

Reachable functions

42

Percentage of reachable functions covered

64.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2430	75.9%
gold	[1:9]	31	0.96%
yellow	[10:29]	44	1.37%
greenyellow	[30:49]	27	0.84%
lawngreen	50+	666	20.8%
All colors	3198	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
229	2731	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02731	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
200	2102	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02102	__cxa_allocate_exception
179	1681	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01681	__cxa_guard_acquire
130	1934	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01934	__cxa_allocate_exception
106	1513	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01513	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
97	2490	QPDFObjectHandle::getObjectID() const	call site: 02490	__cxa_allocate_exception
91	1418	QPDFObjectHandle::getIntValueAsInt() const	call site: 01418	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
77	850	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00850	__cxa_allocate_exception
73	1296	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01296	__cxa_allocate_exception
64	1130	QPDFLogger::defaultLogger()	call site: 01130	__cxa_end_catch
60	2311	QPDF::Doc::Objects::readTrailer()	call site: 02311	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
53	1626	qpdf::BaseDictionary::replace(std::__1::basic_string , std::__1::allocator > const&, QPDFObjectHandle)	call site: 01626	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

481

Functions that are reachable but not covered

817

Reachable functions

1544

Percentage of reachable functions covered

47.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	21
/src/qpdf/libqpdf/QUtil.cc	13
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	24
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	94
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	59
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: future_qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	577	15.9%
gold	[1:9]	100	2.76%
yellow	[10:29]	100	2.76%
greenyellow	[30:49]	48	1.32%
lawngreen	50+	2793	77.1%
All colors	3618	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	44	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00044	__cxa_allocate_exception
11	196	qpdf::Tokenizer::inBeforeToken(char)	call site: 00196	__cxa_allocate_exception
11	1402	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01402
9	1292	qpdf::BaseDictionary::dict() const	call site: 01292	__cxa_allocate_exception
9	2787	QPDF::Doc::Objects::parse(char const*)	call site: 02787	__cxa_begin_catch
8	71	unsigned long QIntC::to_size (long const&)	call site: 00071	__cxa_allocate_exception
8	933	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00933	__cxa_allocate_exception
7	368	QPDF::warn(QPDFExc const&)	call site: 00368	__cxa_allocate_exception
7	2518	QPDFObjectHandle::getKeys() const	call site: 02518	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1058

Functions that are reachable but not covered

245

Reachable functions

1706

Percentage of reachable functions covered

85.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	25
/src/qpdf/libqpdf/QUtil.cc	25
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	112
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	65
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	939	16.4%
gold	[1:9]	86	1.51%
yellow	[10:29]	98	1.72%
greenyellow	[30:49]	60	1.05%
lawngreen	50+	4508	79.2%
All colors	5691	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	5297	(anonymous namespace)::JSONParser::getToken()	call site: 05297	__cxa_allocate_exception
23	2451	qpdf::BaseHandle::copy(bool) const	call site: 02451	__cxa_allocate_exception
19	4298	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04298	__cxa_allocate_exception
19	5426	(anonymous namespace)::JSONParser::handleToken()	call site: 05426	__cxa_allocate_exception
19	5511	(anonymous namespace)::JSONParser::handleToken()	call site: 05511	__cxa_allocate_exception
17	28	qpdf::global::Options::fuzz_mode(bool)	call site: 00028	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
14	4147	qpdf::Stream::copy_data_to(qpdf::Stream&)	call site: 04147	__cxa_allocate_exception
13	5141	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05141
11	46	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00046	__cxa_allocate_exception
11	199	qpdf::Tokenizer::inBeforeToken(char)	call site: 00199	__cxa_allocate_exception
11	1267	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01267	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
11	5379	(anonymous namespace)::JSONParser::getToken()	call site: 05379	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1575

Functions that are reachable but not covered

257

Reachable functions

2350

Percentage of reachable functions covered

89.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	5
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	28
/src/qpdf/libqpdf/QUtil.cc	28
/src/qpdf/libqpdf/QPDF.cc	26
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	38
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	126
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/libqpdf/QPDF_Stream.cc	25
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/BufferInputSource.cc	2
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2430	75.9%
gold	[1:9]	25	0.78%
yellow	[10:29]	32	1.00%
greenyellow	[30:49]	35	1.09%
lawngreen	50+	676	21.1%
All colors	3198	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
229	2731	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02731	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
200	2102	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02102	__cxa_allocate_exception
179	1681	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01681	__cxa_guard_acquire
130	1934	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01934	__cxa_allocate_exception
106	1513	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01513	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
97	2490	QPDFObjectHandle::getObjectID() const	call site: 02490	__cxa_allocate_exception
91	1418	QPDFObjectHandle::getIntValueAsInt() const	call site: 01418	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
77	850	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00850	__cxa_allocate_exception
73	1296	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01296	__cxa_allocate_exception
64	1130	QPDFLogger::defaultLogger()	call site: 01130	__cxa_end_catch
60	2311	QPDF::Doc::Objects::readTrailer()	call site: 02311	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
53	1626	qpdf::BaseDictionary::replace(std::__1::basic_string , std::__1::allocator > const&, QPDFObjectHandle)	call site: 01626	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

480

Functions that are reachable but not covered

817

Reachable functions

1544

Percentage of reachable functions covered

47.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	21
/src/qpdf/libqpdf/QUtil.cc	13
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	24
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	94
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	59
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	947	16.6%
gold	[1:9]	87	1.52%
yellow	[10:29]	95	1.66%
greenyellow	[30:49]	99	1.73%
lawngreen	50+	4463	78.4%
All colors	5691	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	5297	(anonymous namespace)::JSONParser::getToken()	call site: 05297	__cxa_allocate_exception
23	2451	qpdf::BaseHandle::copy(bool) const	call site: 02451	__cxa_allocate_exception
19	4298	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04298	__cxa_allocate_exception
19	5426	(anonymous namespace)::JSONParser::handleToken()	call site: 05426	__cxa_allocate_exception
19	5511	(anonymous namespace)::JSONParser::handleToken()	call site: 05511	__cxa_allocate_exception
17	28	qpdf::global::Options::fuzz_mode(bool)	call site: 00028	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
14	4147	qpdf::Stream::copy_data_to(qpdf::Stream&)	call site: 04147	__cxa_allocate_exception
13	5141	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05141
11	46	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00046	__cxa_allocate_exception
11	199	qpdf::Tokenizer::inBeforeToken(char)	call site: 00199	__cxa_allocate_exception
11	1267	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01267	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
11	4926	void QIntC::range_check_error (long long const&, long long const&)	call site: 04926	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1592

Functions that are reachable but not covered

257

Reachable functions

2350

Percentage of reachable functions covered

89.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	5
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	28
/src/qpdf/libqpdf/QUtil.cc	28
/src/qpdf/libqpdf/QPDF.cc	26
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	38
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	126
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/libqpdf/QPDF_Stream.cc	25
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/BufferInputSource.cc	2
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: future_qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	992	20.3%
gold	[1:9]	97	1.99%
yellow	[10:29]	98	2.01%
greenyellow	[30:49]	48	0.98%
lawngreen	50+	3631	74.6%
All colors	4866	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4750	qpdf::impl::Writer::write()	call site: 04750	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2974	qpdf::impl::Writer::doWriteSetup()	call site: 02974
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
26	2863	qpdf::impl::Writer::generateID(bool)	call site: 02863	__cxa_allocate_exception
18	3548	qpdf::impl::Writer::writeLinearized()	call site: 03548	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4233	qpdf::BaseHandle::unparse() const	call site: 04233	__cxa_allocate_exception
16	2787	QPDF::Doc::Objects::parse(char const*)	call site: 02787	__cxa_begin_catch
16	2912	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02912	__cxa_allocate_exception
16	3021	qpdf::impl::Writer::doWriteSetup()	call site: 03021
15	3800	deflate	call site: 03800	crc32

Runtime coverage analysis

Covered functions

1396

Functions that are reachable but not covered

368

Reachable functions

2208

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	87
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	583	16.1%
gold	[1:9]	111	3.06%
yellow	[10:29]	63	1.74%
greenyellow	[30:49]	50	1.38%
lawngreen	50+	2811	77.6%
All colors	3618	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	44	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00044	__cxa_allocate_exception
11	196	qpdf::Tokenizer::inBeforeToken(char)	call site: 00196	__cxa_allocate_exception
9	1292	qpdf::BaseDictionary::dict() const	call site: 01292	__cxa_allocate_exception
9	2417	qpdf::BaseHandle::copy(bool) const	call site: 02417
9	2787	QPDF::Doc::Objects::parse(char const*)	call site: 02787	__cxa_begin_catch
8	71	unsigned long QIntC::to_size (long const&)	call site: 00071	__cxa_allocate_exception
8	933	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00933	__cxa_allocate_exception
8	1405	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01405
7	368	QPDF::warn(QPDFExc const&)	call site: 00368	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1052

Functions that are reachable but not covered

249

Reachable functions

1706

Percentage of reachable functions covered

85.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	25
/src/qpdf/libqpdf/QUtil.cc	25
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	112
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	65
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1037	21.5%
gold	[1:9]	121	2.51%
yellow	[10:29]	73	1.51%
greenyellow	[30:49]	55	1.14%
lawngreen	50+	3528	73.2%
All colors	4814	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4699	qpdf::impl::Writer::write()	call site: 04699	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
39	4476	qpdf::impl::Writer::writeLinearized()	call site: 04476	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
25	3033	ObjTable ::large_element(unsigned long)	call site: 03033
22	4252	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04252
18	3497	qpdf::impl::Writer::writeLinearized()	call site: 03497	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4182	qpdf::BaseHandle::unparse() const	call site: 04182	__cxa_allocate_exception
16	2787	QPDF::Doc::Objects::parse(char const*)	call site: 02787	__cxa_begin_catch
16	2970	qpdf::impl::Writer::doWriteSetup()	call site: 02970
15	3749	deflate	call site: 03749	crc32

Runtime coverage analysis

Covered functions

1391

Functions that are reachable but not covered

362

Reachable functions

2190

Percentage of reachable functions covered

83.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: future_qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1682	34.5%
gold	[1:9]	109	2.24%
yellow	[10:29]	91	1.87%
greenyellow	[30:49]	33	0.67%
lawngreen	50+	2949	60.6%
All colors	4864	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
237	3266	qpdf::impl::Writer::write()	call site: 03266	__assert_fail
79	4564	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04564	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
73	3082	ObjTable ::large_element(unsigned long)	call site: 03082
57	4469	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04469	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
47	4755	qpdf::impl::Writer::writeStandard()	call site: 04755	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2972	qpdf::impl::Writer::doWriteSetup()	call site: 02972
39	4680	BitWriter::flush()	call site: 04680
35	4406	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04406	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4649	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04649	__cxa_allocate_exception
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
29	3544	(anonymous namespace)::Pl_stack::popper()	call site: 03544	fopen

Runtime coverage analysis

Covered functions

1307

Functions that are reachable but not covered

515

Reachable functions

2206

Percentage of reachable functions covered

76.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1483	30.8%
gold	[1:9]	93	1.93%
yellow	[10:29]	61	1.26%
greenyellow	[30:49]	87	1.80%
lawngreen	50+	3088	64.1%
All colors	4812	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
226	3214	qpdf::impl::Writer::write()	call site: 03214	__assert_fail
120	4471	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04471	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3736	Pl_Flate::checkError(char const*, int)	call site: 03736	deflate
47	4703	qpdf::impl::Writer::writeStandard()	call site: 04703	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
41	2912	qpdf::impl::Writer::generateID(bool)	call site: 02912
39	4628	BitWriter::flush()	call site: 04628
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4597	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04597	__cxa_allocate_exception
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
27	4668	qpdf::pl::Count::~Count()	call site: 04668	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
23	3492	(anonymous namespace)::Pl_stack::popper()	call site: 03492	fopen
23	3541	qpdf::impl::Writer::openObject(int)	call site: 03541	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_

Runtime coverage analysis

Covered functions

1336

Functions that are reachable but not covered

461

Reachable functions

2186

Percentage of reachable functions covered

78.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	83
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: future_qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1472	30.5%
gold	[1:9]	114	2.36%
yellow	[10:29]	52	1.08%
greenyellow	[30:49]	81	1.68%
lawngreen	50+	3093	64.2%
All colors	4812	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
226	3214	qpdf::impl::Writer::write()	call site: 03214	__assert_fail
120	4471	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04471	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3736	Pl_Flate::checkError(char const*, int)	call site: 03736	deflate
47	4703	qpdf::impl::Writer::writeStandard()	call site: 04703	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
41	2912	qpdf::impl::Writer::generateID(bool)	call site: 02912
39	4628	BitWriter::flush()	call site: 04628
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4597	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04597	__cxa_allocate_exception
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
27	4668	qpdf::pl::Count::~Count()	call site: 04668	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
23	3492	(anonymous namespace)::Pl_stack::popper()	call site: 03492	fopen
23	3541	qpdf::impl::Writer::openObject(int)	call site: 03541	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_

Runtime coverage analysis

Covered functions

1338

Functions that are reachable but not covered

465

Reachable functions

2186

Percentage of reachable functions covered

78.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	83
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1680	34.5%
gold	[1:9]	102	2.09%
yellow	[10:29]	88	1.80%
greenyellow	[30:49]	79	1.62%
lawngreen	50+	2915	59.9%
All colors	4864	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
237	3266	qpdf::impl::Writer::write()	call site: 03266	__assert_fail
79	4564	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04564	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
73	3082	ObjTable ::large_element(unsigned long)	call site: 03082
57	4469	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04469	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
47	4755	qpdf::impl::Writer::writeStandard()	call site: 04755	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2972	qpdf::impl::Writer::doWriteSetup()	call site: 02972
39	4680	BitWriter::flush()	call site: 04680
35	4406	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04406	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4649	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04649	__cxa_allocate_exception
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
29	3544	(anonymous namespace)::Pl_stack::popper()	call site: 03544	fopen

Runtime coverage analysis

Covered functions

1304

Functions that are reachable but not covered

511

Reachable functions

2206

Percentage of reachable functions covered

76.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	994	20.4%
gold	[1:9]	106	2.17%
yellow	[10:29]	82	1.68%
greenyellow	[30:49]	76	1.56%
lawngreen	50+	3608	74.1%
All colors	4866	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4750	qpdf::impl::Writer::write()	call site: 04750	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2974	qpdf::impl::Writer::doWriteSetup()	call site: 02974
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
26	2863	qpdf::impl::Writer::generateID(bool)	call site: 02863	__cxa_allocate_exception
18	3548	qpdf::impl::Writer::writeLinearized()	call site: 03548	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4233	qpdf::BaseHandle::unparse() const	call site: 04233	__cxa_allocate_exception
16	2787	QPDF::Doc::Objects::parse(char const*)	call site: 02787	__cxa_begin_catch
16	2912	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02912	__cxa_allocate_exception
16	3021	qpdf::impl::Writer::doWriteSetup()	call site: 03021
15	3800	deflate	call site: 03800	crc32

Runtime coverage analysis

Covered functions

1393

Functions that are reachable but not covered

368

Reachable functions

2208

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	87
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: future_qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1029	21.3%
gold	[1:9]	117	2.43%
yellow	[10:29]	93	1.93%
greenyellow	[30:49]	70	1.45%
lawngreen	50+	3505	72.8%
All colors	4814	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4699	qpdf::impl::Writer::write()	call site: 04699	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
39	4476	qpdf::impl::Writer::writeLinearized()	call site: 04476	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1247	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01247	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2442	qpdf::BaseHandle::copy(bool) const	call site: 02442	__cxa_allocate_exception
25	3033	ObjTable ::large_element(unsigned long)	call site: 03033
22	4252	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04252
18	3497	qpdf::impl::Writer::writeLinearized()	call site: 03497	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4182	qpdf::BaseHandle::unparse() const	call site: 04182	__cxa_allocate_exception
16	2787	QPDF::Doc::Objects::parse(char const*)	call site: 02787	__cxa_begin_catch
16	2970	qpdf::impl::Writer::doWriteSetup()	call site: 02970
15	3749	deflate	call site: 03749	crc32

Runtime coverage analysis

Covered functions

1395

Functions that are reachable but not covered

362

Reachable functions

2190

Percentage of reachable functions covered

83.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	39
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1