High level conclusions

Fuzzer fuzz-journald-native-fd is blocked:

The runtime code coverage of fuzz-journald-native-fd covers 16.83% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-dhcp-server-relay is blocked:

The runtime code coverage of fuzz-dhcp-server-relay covers 16.26% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-journald-native is blocked:

The runtime code coverage of fuzz-journald-native covers 9.325% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-hostname-setup is blocked:

The runtime code coverage of fuzz-hostname-setup covers 14.67% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-calendarspec is blocked:

The runtime code coverage of fuzz-calendarspec covers 16.80% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-fido-id-desc is blocked:

The runtime code coverage of fuzz-fido-id-desc covers 7.796% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-nspawn-settings is blocked:

The runtime code coverage of fuzz-nspawn-settings covers 18.68% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-journald-syslog is blocked:

The runtime code coverage of fuzz-journald-syslog covers 9.126% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-dns-packet is blocked:

The runtime code coverage of fuzz-dns-packet covers 26.26% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-journald-stream is blocked:

The runtime code coverage of fuzz-journald-stream covers 22.46% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-varlink-idl is blocked:

The runtime code coverage of fuzz-varlink-idl covers 25.70% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-udev-rules is blocked:

The runtime code coverage of fuzz-udev-rules covers 16.85% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-bus-match is blocked:

The runtime code coverage of fuzz-bus-match covers 20.80% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-udev-database is blocked:

The runtime code coverage of fuzz-udev-database covers 23.71% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-journald-audit is blocked:

The runtime code coverage of fuzz-journald-audit covers 4.788% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-manager-serialize is blocked:

The runtime code coverage of fuzz-manager-serialize covers 25.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-journald-kmsg is blocked:

The runtime code coverage of fuzz-journald-kmsg covers 17.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-dhcp6-client is blocked:

The runtime code coverage of fuzz-dhcp6-client covers 28.52% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-env-file is blocked:

The runtime code coverage of fuzz-env-file covers 12.58% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-xdg-desktop is blocked:

The runtime code coverage of fuzz-xdg-desktop covers 23.63% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-efi-osrel is blocked:

The runtime code coverage of fuzz-efi-osrel covers 8.783% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-efi-printf is blocked:

The runtime code coverage of fuzz-efi-printf covers 7.457% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-bcd is blocked:

The runtime code coverage of fuzz-bcd covers 8.417% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-lldp-rx is blocked:

The runtime code coverage of fuzz-lldp-rx covers 28.39% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-etc-hosts is blocked:

The runtime code coverage of fuzz-etc-hosts covers 16.03% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-dhcp-client is blocked:

The runtime code coverage of fuzz-dhcp-client covers 28.77% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-catalog is blocked:

The runtime code coverage of fuzz-catalog covers 19.26% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-time-util is blocked:

The runtime code coverage of fuzz-time-util covers 15.16% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-udev-rule-parse-value is blocked:

The runtime code coverage of fuzz-udev-rule-parse-value covers 10.06% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-efi-string is blocked:

The runtime code coverage of fuzz-efi-string covers 9.333% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-bus-label is blocked:

The runtime code coverage of fuzz-bus-label covers 9.060% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 17.01% of cyclomatic complexity.

Fuzzers reach 16.65% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

3227 / 19371

Cyclomatic complexity statically reachable by fuzzers

18251 / 107283

Runtime code coverage of functions

4292 / 19371

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-bus-label

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	767	91.2%
gold	[1:9]	5	0.59%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	69	8.20%
All colors	841	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
662	21	should_parse_proc_cmdline	call site: 00021	proc_cmdline_parse
43	766	log_open	call site: 00766	log_open_syslog
19	746	stderr_is_journal	call site: 00746	extract_first_word
9	690	log_parse_environment_variables	call site: 00690	log_set_max_level_from_string
9	812	log_open	call site: 00812	open_terminal
4	731	log_close_journal	call site: 00731	close_nointr
4	739	log_close_syslog	call site: 00739	log_close_console
2	686	log_parse_environment_variables	call site: 00686	log_set_target
2	706	log_parse_environment_variables	call site: 00706	parse_boolean
2	711	log_parse_environment_variables	call site: 00711	parse_boolean
2	716	log_parse_environment_variables	call site: 00716	parse_boolean
2	721	log_parse_environment_variables	call site: 00721	parse_boolean

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

271

Reachable functions

298

Percentage of reachable functions covered

9.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-bus-label.c	5
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/basic/bus-label.c	7

Fuzzer: fuzz-efi-string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	760	90.4%
gold	[1:9]	3	0.35%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	77	9.16%
All colors	840	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
506	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
150	534	memcpy_safe	call site: 00534	read_full_file
43	767	log_open	call site: 00767	log_open_syslog
19	747	stderr_is_journal	call site: 00747	extract_first_word
9	691	log_parse_environment_variables	call site: 00691	log_set_max_level_from_string
9	813	log_open	call site: 00813	open_terminal
4	732	log_close_journal	call site: 00732	close_nointr
4	740	log_close_syslog	call site: 00740	log_close_console
2	687	log_parse_environment_variables	call site: 00687	log_set_target
2	707	log_parse_environment_variables	call site: 00707	parse_boolean
2	712	log_parse_environment_variables	call site: 00712	parse_boolean
2	717	log_parse_environment_variables	call site: 00717	parse_boolean

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

272

Reachable functions

300

Percentage of reachable functions covered

9.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/boot/fuzz-efi-string.c	12
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2

Fuzzer: fuzz-udev-rule-parse-value

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	759	88.8%
gold	[1:9]	3	0.35%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	92	10.7%
All colors	854	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
605	78	cunescape_one	call site: 00078	pid_get_cmdline_strv
47	21	should_parse_proc_cmdline	call site: 00021	proc_cmdline_parse
43	766	log_open	call site: 00766	log_open_syslog
19	746	stderr_is_journal	call site: 00746	extract_first_word
9	690	log_parse_environment_variables	call site: 00690	log_set_max_level_from_string
9	812	log_open	call site: 00812	open_terminal
4	731	log_close_journal	call site: 00731	close_nointr
4	739	log_close_syslog	call site: 00739	log_close_console
2	686	log_parse_environment_variables	call site: 00686	log_set_target
2	706	log_parse_environment_variables	call site: 00706	parse_boolean
2	711	log_parse_environment_variables	call site: 00711	parse_boolean
2	716	log_parse_environment_variables	call site: 00716	parse_boolean

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

268

Reachable functions

298

Percentage of reachable functions covered

10.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/udev/fuzz-udev-rule-parse-value.c	7
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	11
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	2
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/udev/udev-rules.c	3
src/basic/escape.h	1

Fuzzer: fuzz-time-util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1127	80.0%
gold	[1:9]	12	0.85%
yellow	[10:29]	2	0.14%
greenyellow	[30:49]	4	0.28%
lawngreen	50+	262	18.6%
All colors	1407	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
251	1126	pidref_safe_fork_full	call site: 01126	pidref_set_pid
208	319	endswith	call site: 00319	pid_get_cmdline_strv
150	533	memcpy_safe	call site: 00533	read_full_file
106	120	startswith	call site: 00120	get_proc_field
95	21	should_parse_proc_cmdline	call site: 00021	proc_cmdline_parse
76	238	verify_stat_at	call site: 00238	fd_reopen
65	1000	pidref_is_self	call site: 01000	pidref_get_comm
43	766	log_open	call site: 00766	log_open_syslog
19	746	stderr_is_journal	call site: 00746	extract_first_word
17	1103	pidref_safe_fork_full	call site: 01103	pidref_set_pid
13	979	pidref_safe_fork_full	call site: 00979	wait_for_terminate_and_check
13	1089	wait_for_terminate_and_check	call site: 01089	raw_clone

Runtime coverage analysis

Covered functions

78

Functions that are reachable but not covered

386

Reachable functions

455

Percentage of reachable functions covered

15.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-time-util.c	11
src/fuzz/fuzz.h	3
src/basic/log.c	61
src/basic/process-util.c	83
src/basic/argv-util.c	18
src/basic/parse-util.c	16
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	5
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	43
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	2
src/basic/time-util.c	56
src/basic/time-util.h	4
src/basic/string-util.h	2
src/basic/io-util.c	7
src/basic/io-util.h	1
src/basic/process-util.h	1
src/basic/pidref.h	2
src/basic/pidref.c	16
src/basic/pidfd-util.c	24
src/basic/mountpoint-util.c	9
src/basic/signal-util.c	8
src/basic/raw-clone.h	3
src/basic/capability-util.c	2
src/basic/rlimit-util.c	5
src/boot/efi-log.c	1

Fuzzer: fuzz-catalog

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	762	76.8%
gold	[1:9]	19	1.91%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.40%
lawngreen	50+	207	20.8%
All colors	992	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
157	320	endswith	call site: 00320	pid_get_cmdline_strv
155	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
150	534	memcpy_safe	call site: 00534	read_full_file
114	201	read_line_full	call site: 00201	get_proc_field
52	480	page_size	call site: 00480	pid_get_comm
43	767	log_open	call site: 00767	log_open_syslog
19	747	stderr_is_journal	call site: 00747	extract_first_word
9	691	log_parse_environment_variables	call site: 00691	log_set_max_level_from_string
9	813	log_open	call site: 00813	open_terminal
7	947	reset_direct_storage	call site: 00947
4	740	log_close_syslog	call site: 00740	log_close_console
3	915	memdup	call site: 00915	ordered_hashmap_ensure_put

Runtime coverage analysis

Covered functions

135

Functions that are reachable but not covered

285

Reachable functions

353

Percentage of reachable functions covered

19.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-catalog.c	7
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	9
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/basic/tmpfile-util.c	4
src/libsystemd/sd-journal/catalog.c	36
src/libsystemd/sd-id128/sd-id128.c	3
src/basic/hashmap.h	5
src/basic/hashmap.c	27
src/basic/mempool.c	10
src/basic/string-util.h	1

Fuzzer: fuzz-dhcp-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2838	73.0%
gold	[1:9]	24	0.61%
yellow	[10:29]	30	0.77%
greenyellow	[30:49]	8	0.20%
lawngreen	50+	983	25.3%
All colors	3883	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
279	1750	dhcp_identifier_set_iaid	call site: 01750	net_get_persistent_name
220	3576	memdup	call site: 03576	rtnl_get_ifname_full
206	3270	in_addr_port_ifindex_name_from_string_auto	call site: 03270	rtnl_resolve_interface
140	342	path_extract_directory	call site: 00342	pid_get_cmdline_strv
132	2102	strlen_ptr	call site: 02102	read_virtual_file_fd
106	2235	safe_atou	call site: 02235	device_read_db
99	945	prioq_remove	call site: 00945	remove_recursive
96	1209	event_source_time_prioq_remove	call site: 01209	event_gc_inode_data
81	2437	timespec_load	call site: 02437	client_initialize_events
66	1096	bucket_at	call site: 01096	dir_cleanup
63	2750	dhcp_option_parse	call site: 02750	parse_roothashsig_option
59	3491	parse_time	call site: 03491	socket_read_message

Runtime coverage analysis

Covered functions

417

Functions that are reachable but not covered

693

Reachable functions

973

Percentage of reachable functions covered

28.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd-network/fuzz-dhcp-client.c	17
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	21
src/basic/parse-util.h	6
src/basic/proc-cmdline.c	21
src/basic/strv.c	18
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	71
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	25
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	22
src/basic/stat-util.h	1
src/basic/fs-util.h	5
src/basic/fs-util.c	27
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	25
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	41
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	14
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	7
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	12
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	3
src/basic/time-util.c	13
src/basic/time-util.h	4
src/libsystemd-network/sd-dhcp-client.c	61
src/basic/hashmap.c	57
src/basic/mempool.c	10
src/libsystemd/sd-event/sd-event.c	110
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	13
src/basic/set.h	6
src/basic/glob-util.c	4
src/basic/ether-addr-util.c	2
src/libsystemd/sd-event/event-util.h	1
src/shared/dns-domain.c	10
src/basic/hostname-util.c	2
src/libsystemd-network/sd-dhcp6-client.c	12
src/libsystemd-network/sd-dhcp-client-id.c	5
src/libsystemd-network/sd-dhcp-duid.c	18
src/libsystemd-network/network-common.c	2
src/libsystemd/sd-id128/sd-id128.c	5
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	7
src/basic/io-util.h	1
src/basic/unaligned.h	3
src/basic/sparse-endian.h	3
src/basic/siphash24.c	8
src/shared/netif-util.c	3
src/libsystemd/sd-device/sd-device.c	97
src/basic/chase.c	60
src/basic/user-util.c	17
src/libsystemd/sd-device/device-internal.h	1
src/libsystemd/sd-device/device-private.c	8
src/basic/user-util.h	1
src/libsystemd/sd-device/device-private.h	1
src/basic/string-util.h	2
src/basic/random-util.h	1
src/basic/random-util.c	15
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/libsystemd-network/test-dhcp-client.c	1
src/basic/inotify-util.c	4
src/libsystemd/sd-event/event-util.c	13
src/libsystemd-network/sd-dhcp-lease.c	72
src/libsystemd-network/dhcp-option.c	3
src/veritysetup/veritysetup.c	27
src/basic/hexdecoct.h	2
src/shared/fstab-util.c	10
src/shared/device-nodes.c	7
src/basic/utf8.c	5
src/basic/in-addr-util.c	7
src/basic/tmpfile-util.c	25
src/basic/tmpfile-util.h	1
src/libsystemd-network/network-internal.c	25
src/libsystemd-network/sd-dns-resolver.c	11
src/shared/socket-netlink.c	11
src/libsystemd/sd-netlink/netlink-util.h	2
src/libsystemd/sd-netlink/netlink-util.c	40
src/libsystemd/sd-netlink/sd-netlink.c	37
src/libsystemd/sd-netlink/netlink-socket.c	45
src/libsystemd/sd-netlink/netlink-message-rtnl.c	17
src/libsystemd/sd-netlink/netlink-message.c	54
src/libsystemd/sd-netlink/netlink-types.c	12
src/libsystemd/sd-netlink/netlink-types-rtnl.c	1
src/libsystemd/sd-netlink/netlink-types-nfnl.c	4
src/libsystemd/sd-netlink/netlink-genl.c	6
src/libsystemd/sd-netlink/netlink-types-genl.c	1
src/libsystemd/sd-netlink/netlink-types-sdnl.c	1
src/libsystemd/sd-netlink/netlink-internal.h	2
src/basic/ordered-set.h	5
src/basic/ordered-set.c	3
src/basic/prioq.h	1

Fuzzer: fuzz-etc-hosts

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	815	77.9%
gold	[1:9]	9	0.86%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	221	21.1%
All colors	1045	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
276	201	read_line_full	call site: 00201	pid_get_cmdline_strv
150	534	memcpy_safe	call site: 00534	read_full_file
89	88	extract_first_word	call site: 00088	detect_container
52	480	page_size	call site: 00480	pid_get_comm
43	767	log_open	call site: 00767	log_open_syslog
38	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
36	871	parse_line	call site: 00871	strstrip
19	747	stderr_is_journal	call site: 00747	extract_first_word
15	68	extract_first_word	call site: 00068	cunescape_one
14	850	parse_line	call site: 00850	utf8_is_valid
13	964	hashmap_iterate_entry	call site: 00964
9	691	log_parse_environment_variables	call site: 00691	log_set_max_level_from_string

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

424

Reachable functions

505

Percentage of reachable functions covered

16.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/resolve/fuzz-etc-hosts.c	6
src/fuzz/fuzz.h	5
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	66
src/fundamental/string-util-fundamental.c	5
src/basic/socket-util.c	14
src/boot/efi-string.c	6
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	9
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/resolve/resolved-etc-hosts.c	24
src/basic/string-util.h	1
src/shared/conf-parser.c	22
src/basic/utf8.h	1
src/basic/utf8.c	7
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1
src/basic/hashmap.h	4
src/basic/hashmap.c	37
src/basic/hostname-util.c	3
src/basic/in-addr-util.c	6
src/basic/sparse-endian.h	1
src/basic/set.h	2
src/basic/mempool.c	1

Fuzzer: fuzz-lldp-rx

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1909	72.6%
gold	[1:9]	53	2.01%
yellow	[10:29]	2	0.07%
greenyellow	[30:49]	1	0.03%
lawngreen	50+	661	25.1%
All colors	2626	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
240	241	strempty	call site: 00241	pid_get_cmdline_strv
172	26	should_parse_proc_cmdline	call site: 00026	proc_cmdline_parse
150	538	memcpy_safe	call site: 00538	read_full_file
127	888	prioq_remove	call site: 00888	remove_recursive
112	1039	bucket_at	call site: 01039	dir_cleanup
93	2003	process_watchdog	call site: 02003	arm_watchdog
79	1159	hashmap_get	call site: 01159	event_gc_inode_data
71	1482	hashmap_put	call site: 01482	inode_data_realize_watch
65	1822	usec_add	call site: 01822	sleep_between
49	1560	shuffle_down	call site: 01560	dns_name_compare_func
43	771	log_open	call site: 00771	log_open_syslog
41	1944	process_io	call site: 01944	process_signal

Runtime coverage analysis

Covered functions

314

Functions that are reachable but not covered

512

Reachable functions

715

Percentage of reachable functions covered

28.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd-network/fuzz-lldp-rx.c	18
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	5
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	70
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	22
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	15
src/basic/stat-util.c	19
src/basic/stat-util.h	1
src/basic/fs-util.h	4
src/basic/fs-util.c	19
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	14
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	27
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	13
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	12
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	6
src/basic/time-util.h	3
src/libsystemd/sd-event/sd-event.c	186
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	7
src/basic/hashmap.c	48
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/libsystemd-network/sd-lldp-rx.c	22
src/libsystemd-network/test-lldp-rx.c	1
src/basic/inotify-util.c	4
src/shared/dns-domain.c	10
src/basic/hostname-util.c	2
src/libsystemd/sd-event/event-util.h	1
src/fundamental/logarithm.h	1
src/basic/prioq.h	1
src/shared/tests.c	5
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/basic/process-util.h	1
src/libsystemd/sd-daemon/sd-daemon.c	38
src/basic/iovec-util.c	3
src/basic/ratelimit.c	5
src/libsystemd-network/lldp-neighbor.c	21
src/basic/ether-addr-util.c	2
src/basic/in-addr-util.c	5
src/libsystemd/sd-json/sd-json.c	67
src/basic/memstream-util.c	2
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9

Fuzzer: fuzz-link-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1015	51.8%
gold	[1:9]	62	3.16%
yellow	[10:29]	22	1.12%
greenyellow	[30:49]	2	0.10%
lawngreen	50+	858	43.7%
All colors	1959	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
65	1689	loop_read	call site: 01689	fallback_random_bytes
43	769	log_open	call site: 00769	log_open_syslog
42	1039	readlinkat_malloc	call site: 01039	fd_get_path
37	649	read_full_stream_full	call site: 00649	strv_split_full
34	612	read_full_stream_full	call site: 00612	unbase64mem_full
31	133	xfopenat_full	call site: 00133	xfopenat_unix_socket
31	492	read_virtual_file_at	call site: 00492	pid_get_comm
30	1545	utf8_encoded_valid_unichar	call site: 01545	send_one_fd_sa
29	1256	conf_files_list_strv	call site: 01256	files_add
27	898	fds_are_same_mount	call site: 00898	path_get_mnt_id_at_fallback
26	1490	strstrip	call site: 01490	sd_journal_sendv
23	376	xopenat_full	call site: 00376	chattr_fd

Runtime coverage analysis

Covered functions

508

Functions that are reachable but not covered

374

Reachable functions

608

Percentage of reachable functions covered

38.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/udev/net/fuzz-link-parser.c	10
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	18
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	69
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	20
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	26
src/basic/stat-util.h	2
src/basic/fs-util.h	2
src/basic/fs-util.c	22
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	20
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	37
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	6
src/basic/string-util.c	13
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	4
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	2
src/basic/time-util.c	5
src/basic/time-util.h	2
src/basic/tmpfile-util.c	6
src/udev/net/link-config.c	32
src/basic/chase.c	70
src/basic/mountpoint-util.c	16
src/basic/user-util.c	15
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/shared/conf-parser.c	50
src/basic/conf-files.c	25
src/basic/hashmap.h	7
src/basic/hashmap.c	61
src/basic/set.h	5
src/basic/mempool.c	10
src/basic/string-util.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	1
src/basic/memfd-util.c	11
src/basic/utf8.c	12
src/basic/utf8.h	1
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1
src/fundamental/logarithm.h	2
src/basic/random-util.c	15
src/basic/io-util.c	7
src/basic/io-util.h	1
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/shared/net-condition.c	3
src/shared/condition.c	5
src/basic/ether-addr-util.c	11
src/basic/in-addr-util.c	5
src/basic/in-addr-util.h	1
src/shared/creds-util.c	11
src/shared/netif-sriov.c	13
src/shared/conf-parser.h	1

Fuzzer: fuzz-nspawn-oci

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	664	52.1%
gold	[1:9]	8	0.62%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.15%
lawngreen	50+	600	47.0%
All colors	1274	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
63	344	path_extract_directory	call site: 00344	fd_reopen_condition
58	413	is_fs_type	call site: 00413	pid_get_cmdline_strv
49	170	negative_errno	call site: 00170	get_proc_field
48	1224	sd_json_dispatch_full	call site: 01224	sd_bus_message_seal
34	617	read_full_stream_full	call site: 00617	unbase64mem_full
29	662	secure_getenv_bool	call site: 00662	in_initrd
26	791	fd_set_sndbuf	call site: 00791	log_open_syslog
25	99	strv_split_full	call site: 00099	detect_container
23	252	fd_reopen	call site: 00252	proc_fd_enoent_errno
21	514	cellescape	call site: 00514	strv_parse_nulstr_full
20	223	xstatfsat	call site: 00223	xopenat
19	149	sockaddr_un_set_path	call site: 00149	connect_unix_path

Runtime coverage analysis

Covered functions

500

Functions that are reachable but not covered

259

Reachable functions

414

Percentage of reachable functions covered

37.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/nspawn/fuzz-nspawn-oci.c	7
src/fuzz/fuzz.h	5
src/basic/fileio.c	66
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	7
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/nspawn/nspawn-oci.c	17
src/libsystemd/sd-json/sd-json.c	109
src/basic/utf8.c	7
src/libsystemd/sd-bus/bus-message.c	24
src/basic/memfd-util.c	5

Fuzzer: fuzz-bcd

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	765	91.7%
gold	[1:9]	3	0.35%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.11%
lawngreen	50+	65	7.79%
All colors	834	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
510	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
150	534	memcpy_safe	call site: 00534	read_full_file
43	767	log_open	call site: 00767	log_open_syslog
19	747	stderr_is_journal	call site: 00747	extract_first_word
9	691	log_parse_environment_variables	call site: 00691	log_set_max_level_from_string
9	813	log_open	call site: 00813	open_terminal
4	732	log_close_journal	call site: 00732	close_nointr
4	740	log_close_syslog	call site: 00740	log_close_console
2	687	log_parse_environment_variables	call site: 00687	log_set_target
2	707	log_parse_environment_variables	call site: 00707	parse_boolean
2	712	log_parse_environment_variables	call site: 00712	parse_boolean
2	717	log_parse_environment_variables	call site: 00717	parse_boolean

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

272

Reachable functions

297

Percentage of reachable functions covered

8.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/boot/fuzz-bcd.c	7
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/basic/utf8.c	1

Fuzzer: fuzz-journal-remote

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2801	62.9%
gold	[1:9]	41	0.92%
yellow	[10:29]	4	0.08%
greenyellow	[30:49]	4	0.08%
lawngreen	50+	1602	35.9%
All colors	4452	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
210	2414	fd_is_fs_type	call site: 02414	copy_file_fd_at_full
123	3411	greedy_realloc	call site: 03411	decompress_blob
120	538	memcpy_safe	call site: 00538	read_full_file
99	969	prioq_remove	call site: 00969	remove_recursive
96	2999	journal_file_append_entry	call site: 02999	journal_file_maybe_append_tag
82	2731	fsync_directory_of_file	call site: 02731	link_tmpfile_at
78	2878	journal_directory_vacuum	call site: 02878	unlinkat_deallocate
72	49	mangle_base	call site: 00049	proc_cmdline_parse
71	410	is_fs_type	call site: 00410	pid_get_cmdline_strv
63	1123	ordered_hashmap_get	call site: 01123	dir_cleanup
60	1257	hashmap_remove	call site: 01257	event_gc_inode_data
55	1978	mmap_cache_process_sigbus	call site: 01978	sd_journal_print

Runtime coverage analysis

Covered functions

615

Functions that are reachable but not covered

672

Reachable functions

1043

Percentage of reachable functions covered

35.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/journal-remote/fuzz-journal-remote.c	27
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	68
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	20
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	9
src/basic/stat-util.c	26
src/basic/stat-util.h	1
src/basic/fs-util.h	5
src/basic/fs-util.c	57
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	15
src/basic/label.c	3
src/basic/btrfs.c	18
src/basic/path-util.c	31
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	15
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	17
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	7
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	6
src/basic/time-util.h	4
src/basic/tmpfile-util.c	32
src/basic/memfd-util.c	15
src/basic/utf8.c	11
src/journal-remote/journal-remote.c	39
src/libsystemd/sd-event/sd-event.c	96
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	10
src/basic/hashmap.c	54
src/basic/set.h	5
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/journal-remote/journal-remote-write.c	17
src/shared/journal-file-util.c	48
src/shared/dns-domain.c	10
src/basic/hostname-util.c	2
src/journal-remote/journal-remote-parse.c	10
src/shared/journal-importer.c	45
src/basic/iovec-wrapper.c	6
src/libsystemd/sd-journal/journal-file.c	147
src/libsystemd/sd-id128/sd-id128.c	9
src/basic/unaligned.h	1
src/basic/sparse-endian.h	2
src/libsystemd/sd-journal/journal-file.h	8
src/libsystemd/sd-journal/mmap-cache.c	39
src/basic/sigbus.c	6
src/boot/efi-log.c	6
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/string-util.h	1
src/shared/copy.c	65
src/shared/selinux-util.c	36
src/basic/mallinfo-util.h	1
src/basic/random-util.h	1
src/basic/random-util.c	15
src/basic/io-util.c	7
src/basic/io-util.h	1
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/basic/signal-util.c	2
src/basic/xattr-util.h	1
src/basic/xattr-util.c	37
src/basic/sync-util.c	15
src/basic/gcrypt-util.h	1
src/libsystemd/sd-journal/journal-vacuum.c	32
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/libsystemd/sd-journal/journal-authenticate.c	29
src/libsystemd/sd-journal/fsprg.c	26
src/basic/gcrypt-util.c	7
src/basic/macro.h	1
src/basic/ratelimit.c	5
src/basic/siphash24.c	8
src/libsystemd/sd-journal/lookup3.h	1
src/libsystemd/sd-journal/lookup3.c	2
src/basic/compress.c	44
src/basic/compress.h	3
src/basic/iovec-util.c	2
src/libsystemd/sd-journal/sd-journal.c	99
src/basic/filesystems.c	6
src/shared/logs-show.c	14
src/basic/prioq.h	1

Fuzzer: fuzz-efi-printf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	766	90.0%
gold	[1:9]	3	0.35%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	82	9.63%
All colors	851	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
662	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
43	767	log_open	call site: 00767	log_open_syslog
19	747	stderr_is_journal	call site: 00747	extract_first_word
9	691	log_parse_environment_variables	call site: 00691	log_set_max_level_from_string
9	813	log_open	call site: 00813	open_terminal
4	732	log_close_journal	call site: 00732	close_nointr
4	740	log_close_syslog	call site: 00740	log_close_console
2	687	log_parse_environment_variables	call site: 00687	log_set_target
2	707	log_parse_environment_variables	call site: 00707	parse_boolean
2	712	log_parse_environment_variables	call site: 00712	parse_boolean
2	717	log_parse_environment_variables	call site: 00717	parse_boolean
2	722	log_parse_environment_variables	call site: 00722	parse_boolean

Runtime coverage analysis

Covered functions

37

Functions that are reachable but not covered

273

Reachable functions

295

Percentage of reachable functions covered

7.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/boot/fuzz-efi-printf.c	4
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2

Fuzzer: fuzz-efi-osrel

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	760	90.3%
gold	[1:9]	3	0.35%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	78	9.27%
All colors	841	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
506	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
150	534	memcpy_safe	call site: 00534	read_full_file
43	767	log_open	call site: 00767	log_open_syslog
19	747	stderr_is_journal	call site: 00747	extract_first_word
9	691	log_parse_environment_variables	call site: 00691	log_set_max_level_from_string
9	813	log_open	call site: 00813	open_terminal
4	732	log_close_journal	call site: 00732	close_nointr
4	740	log_close_syslog	call site: 00740	log_close_console
2	687	log_parse_environment_variables	call site: 00687	log_set_target
2	707	log_parse_environment_variables	call site: 00707	parse_boolean
2	712	log_parse_environment_variables	call site: 00712	parse_boolean
2	717	log_parse_environment_variables	call site: 00717	parse_boolean

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

270

Reachable functions

296

Percentage of reachable functions covered

8.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/boot/fuzz-efi-osrel.c	6
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2

Fuzzer: fuzz-xdg-desktop

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1346	70.4%
gold	[1:9]	13	0.68%
yellow	[10:29]	10	0.52%
greenyellow	[30:49]	3	0.15%
lawngreen	50+	539	28.2%
All colors	1911	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
218	1184	path_make_absolute_cwd	call site: 01184	chaseat
168	338	path_simplify_full	call site: 00338	pid_get_cmdline_strv
132	555	strv_length	call site: 00555	read_full_file
131	1610	generator_open_unit_file_full	call site: 01610	fopen_temporary
47	1452	find_executable_full	call site: 01452	default_PATH
44	1131	statx_inode_same	call site: 01131	path_get_mnt_id_at_fallback
43	770	log_open	call site: 00770	log_open_syslog
39	1806	generator_add_symlink_full	call site: 01806	unit_name_replace_instance
35	25	should_parse_proc_cmdline	call site: 00025	proc_cmdline_parse
31	134	xfopenat_full	call site: 00134	xfopenat_unix_socket
27	1406	stat_verify_regular	call site: 01406	path_extract_filename
26	509	cescape_char	call site: 00509	strv_parse_nulstr_full

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

449

Reachable functions

588

Percentage of reachable functions covered

23.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/xdg-autostart-generator/fuzz-xdg-desktop.c	11
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	19
src/basic/extract-word.c	8
src/basic/escape.c	22
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	67
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	20
src/boot/efi-string.c	5
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	29
src/basic/stat-util.h	2
src/basic/fs-util.h	3
src/basic/fs-util.c	42
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	20
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	57
src/basic/path-util.h	5
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	17
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	6
src/basic/strv.h	3
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	2
src/basic/time-util.c	5
src/basic/time-util.h	2
src/basic/tmpfile-util.c	28
src/xdg-autostart-generator/xdg-autostart-service.c	43
src/shared/conf-parser.c	36
src/basic/string-util.h	2
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	1
src/basic/memfd-util.c	11
src/basic/utf8.c	12
src/basic/utf8.h	1
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1
src/basic/chase.c	60
src/basic/mountpoint-util.c	17
src/basic/user-util.c	20
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/basic/escape.h	3
src/shared/specifier.c	1
src/shared/generator.h	2
src/shared/generator.c	18
src/basic/tmpfile-util.h	1
src/basic/random-util.h	1
src/basic/random-util.c	15
src/basic/io-util.c	7
src/basic/io-util.h	1
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/basic/unit-name.h	1
src/basic/unit-name.c	16
src/shared/mkdir-label.h	1
src/shared/mkdir-label.c	1
src/basic/mkdir.c	19

Fuzzer: fuzz-env-file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	734	83.8%
gold	[1:9]	3	0.34%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	138	15.7%
All colors	875	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
411	127	startswith	call site: 00127	pid_get_cmdline_strv
95	28	should_parse_proc_cmdline	call site: 00028	proc_cmdline_parse
43	773	log_open	call site: 00773	log_open_syslog
38	652	read_full_stream_full	call site: 00652	strv_split_full
34	616	read_full_stream_full	call site: 00616	unbase64mem_full
24	558	strv_length	call site: 00558	read_full_file
19	753	stderr_is_journal	call site: 00753	extract_first_word
12	540	memcpy_safe	call site: 00540	proc_cmdline_filter_pid1_args
9	697	log_parse_environment_variables	call site: 00697	log_set_max_level_from_string
9	819	log_open	call site: 00819	open_terminal
7	589	read_full_stream_full	call site: 00589	warn_file_is_world_accessible
5	599	read_full_stream_full	call site: 00599	memcpy_safe

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

264

Reachable functions

302

Percentage of reachable functions covered

12.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-env-file.c	8
src/fuzz/fuzz.h	5
src/basic/fileio.c	66
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	7
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/basic/env-file.c	10

Fuzzer: fuzz-bootspec

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	822	48.5%
gold	[1:9]	71	4.19%
yellow	[10:29]	11	0.64%
greenyellow	[30:49]	1	0.05%
lawngreen	50+	788	46.5%
All colors	1693	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
132	553	strv_length	call site: 00553	read_full_file
72	457	detect_container	call site: 00457	pid_get_cmdline_strv
71	336	path_simplify_full	call site: 00336	fd_reopen_condition
43	768	log_open	call site: 00768	log_open_syslog
33	238	strempty	call site: 00238	fd_reopen
30	132	xfopenat_full	call site: 00132	xfopenat_unix_socket
29	423	detect_container	call site: 00423	running_in_pidns
26	211	get_proc_field	call site: 00211	path_is_fs_type
26	1650	print_cmdline	call site: 01650	print_addon
20	1227	boot_load_efi_entry_pointers	call site: 01227	efi_get_variable_string
19	748	stderr_is_journal	call site: 00748	extract_first_word
18	282	path_find_first_component	call site: 00282	path_find_last_component

Runtime coverage analysis

Covered functions

300

Functions that are reachable but not covered

314

Reachable functions

504

Percentage of reachable functions covered

37.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-bootspec.c	17
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	21
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	66
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	15
src/basic/stat-util.c	16
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	30
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	2
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/libsystemd/sd-json/sd-json.c	127
src/basic/utf8.c	7
src/shared/bootspec.c	68
src/shared/bootspec.h	2
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9
src/shared/pretty-print.c	16
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9

Fuzzer: fuzz-dhcp6-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2680	72.1%
gold	[1:9]	22	0.59%
yellow	[10:29]	2	0.05%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1010	27.1%
All colors	3714	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
356	125	startswith	call site: 00125	pid_get_cmdline_strv
344	1604	dhcp_identifier_set_iaid	call site: 01604	net_get_persistent_name
190	2001	hashmap_base_ensure_allocated	call site: 02001	device_read_db
132	556	strv_length	call site: 00556	read_full_file
112	1040	bucket_at	call site: 01040	dir_cleanup
99	889	prioq_remove	call site: 00889	remove_recursive
95	26	should_parse_proc_cmdline	call site: 00026	proc_cmdline_parse
92	3459	process_watchdog	call site: 03459	arm_watchdog
82	1157	event_source_is_online	call site: 01157	event_gc_inode_data
81	3004	dhcp6_lease_get_clientid	call site: 03004	sd_dhcp6_client_start
68	2416	sd_event_source_set_priority	call site: 02416	inode_data_realize_watch
63	2569	random_bytes	call site: 02569	fallback_random_bytes

Runtime coverage analysis

Covered functions

410

Functions that are reachable but not covered

639

Reachable functions

894

Percentage of reachable functions covered

28.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd-network/fuzz-dhcp6-client.c	33
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	5
src/basic/parse-util.c	15
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	18
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	68
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	22
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	22
src/basic/stat-util.h	1
src/basic/fs-util.h	4
src/basic/fs-util.c	21
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	20
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	39
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	13
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	2
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	2
src/basic/time-util.c	6
src/basic/time-util.h	4
src/libsystemd/sd-event/sd-event.c	192
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	13
src/basic/hashmap.c	61
src/basic/set.h	6
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/libsystemd-network/sd-dhcp6-client.c	81
src/basic/in-addr-util.c	3
src/basic/sparse-endian.h	3
src/basic/hostname-util.c	6
src/shared/dns-domain.h	1
src/shared/dns-domain.c	19
src/shared/web-util.c	3
src/basic/utf8.h	1
src/basic/utf8.c	1
src/libsystemd-network/sd-dhcp6-lease.c	9
src/libsystemd-network/dhcp6-option.c	20
src/basic/ordered-set.h	3
src/basic/ordered-set.c	3
src/libsystemd-network/sd-dhcp-duid.c	18
src/shared/netif-util.c	3
src/libsystemd/sd-device/sd-device.c	97
src/basic/chase.c	60
src/basic/user-util.c	17
src/libsystemd/sd-device/device-internal.h	1
src/libsystemd/sd-device/device-private.c	8
src/basic/user-util.h	1
src/libsystemd/sd-device/device-private.h	1
src/basic/string-util.h	2
src/basic/siphash24.c	8
src/basic/unaligned.h	3
src/libsystemd-network/network-common.c	2
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	7
src/basic/io-util.h	1
src/libsystemd-network/test-dhcp6-client.c	44
src/basic/inotify-util.c	4
src/basic/random-util.h	1
src/basic/random-util.c	15
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/libsystemd/sd-event/event-util.c	13
src/libsystemd/sd-event/event-util.h	1
src/fundamental/logarithm.h	1
src/basic/prioq.h	1
src/shared/tests.c	5
src/basic/process-util.h	1
src/libsystemd/sd-daemon/sd-daemon.c	38
src/basic/iovec-util.c	3
src/basic/ratelimit.c	5

Fuzzer: fuzz-journald-kmsg

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6639	84.2%
gold	[1:9]	55	0.69%
yellow	[10:29]	62	0.78%
greenyellow	[30:49]	22	0.27%
lawngreen	50+	1104	14.0%
All colors	7882	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1597	5178	ordered_hashmap_free	call site: 05178	manager_find_journal
664	3520	manager_dispatch_message	call site: 03520	manager_dispatch_message_real
565	7313	sync_req_revalidate_by_timestamp	call site: 07313	sync_req_revalidate
494	4269	client_context_try_shrink_to	call site: 04269	manager_write_to_journal
487	6821	siphash24_finalize	call site: 06821	manager_find_journal
410	4766	random_bytes	call site: 04766	journal_file_offline_close
226	2087	delete_trailing_chars	call site: 02087	manager_flush_server_names
186	1900	readlinkat_malloc	call site: 01900	manager_network_read_link_servers
117	1042	_hashmap_get	call site: 01042	dir_cleanup
96	1798	usec_add	call site: 01798	sd_resolve_attach_event
79	575	read_full_file_full	call site: 00575	strv_split_full
75	1601	strv_find	call site: 01601	sd_event_set_watchdog

Runtime coverage analysis

Covered functions

389

Functions that are reachable but not covered

1409

Reachable functions

1718

Percentage of reachable functions covered

17.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/journal/fuzz-journald-kmsg.c	7
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	45
src/basic/argv-util.c	4
src/basic/parse-util.c	15
src/basic/parse-util.h	6
src/basic/proc-cmdline.c	21
src/basic/strv.c	19
src/basic/extract-word.c	8
src/basic/escape.c	27
src/basic/virt.c	20
src/basic/fileio.h	10
src/basic/fileio.c	106
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	42
src/boot/efi-string.c	6
src/basic/errno-util.h	5
src/basic/terminal-util.c	15
src/basic/stat-util.c	25
src/basic/stat-util.h	1
src/basic/fs-util.h	6
src/basic/fs-util.c	68
src/fundamental/string-util-fundamental.h	6
src/basic/fd-util.c	29
src/basic/label.c	3
src/basic/btrfs.c	18
src/basic/path-util.c	44
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	15
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	22
src/boot/util.c	8
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	7
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	4
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	3
src/basic/time-util.c	13
src/basic/time-util.h	4
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	159
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	17
src/basic/hashmap.c	56
src/basic/set.h	7
src/basic/glob-util.c	5
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	58
src/basic/string-util.h	4
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	5
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	13
src/basic/io-util.c	7
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	4
src/basic/memfd-util.c	11
src/basic/utf8.c	17
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/journal/fuzz-journald.c	4
src/journal/journald-kmsg.c	31
src/libsystemd/sd-device/sd-device.c	110
src/basic/devnum-util.c	7
src/basic/chase.c	67
src/basic/user-util.c	37
src/libsystemd/sd-device/device-internal.h	1
src/libsystemd/sd-device/device-private.c	4
src/basic/user-util.h	2
src/libsystemd/sd-netlink/netlink-util.h	2
src/libsystemd/sd-netlink/netlink-util.c	28
src/libsystemd/sd-netlink/sd-netlink.c	37
src/libsystemd/sd-netlink/netlink-socket.c	45
src/libsystemd/sd-netlink/netlink-message-rtnl.c	17
src/libsystemd/sd-netlink/netlink-message.c	46
src/libsystemd/sd-netlink/netlink-types.c	12
src/libsystemd/sd-netlink/netlink-types-rtnl.c	1
src/libsystemd/sd-netlink/netlink-types-nfnl.c	4
src/libsystemd/sd-netlink/netlink-genl.c	6
src/libsystemd/sd-netlink/netlink-types-genl.c	1
src/libsystemd/sd-netlink/netlink-types-sdnl.c	1
src/libsystemd/sd-netlink/netlink-internal.h	2
src/basic/ordered-set.h	5
src/basic/ordered-set.c	3
src/basic/prioq.h	1
src/journal/journald-syslog.c	5
src/basic/ratelimit.c	5
src/journal/journald-manager.c	144
src/journal/journald-rate-limit.c	21
src/fundamental/logarithm.h	1
src/journal/journald-context.c	87
src/basic/process-util.h	2
src/basic/gunicode.c	2
src/basic/capability-util.c	8
src/basic/pidref.h	1
src/basic/capability-util.h	1
src/basic/pidref.c	13
src/basic/pidfd-util.c	24
src/basic/audit-util.c	13
src/journal/journald-client.c	15
src/basic/unit-name.c	9
src/basic/xattr-util.h	2
src/basic/xattr-util.c	37
src/basic/nulstr-util.h	1
src/shared/pcre2-util.c	16
src/basic/login-util.c	2
src/basic/capsule-util.c	3
src/basic/utf8.h	1
src/basic/unaligned.h	1
src/libsystemd/sd-journal/journal-file.c	144
src/basic/procfs-util.c	9
src/libsystemd/sd-event/event-util.c	3
src/journal/journald-socket.c	24
src/shared/journal-file-util.c	48
src/libsystemd/sd-journal/journal-file.h	8
src/libsystemd/sd-journal/mmap-cache.c	41
src/basic/sigbus.c	6
src/boot/efi-log.c	6
src/shared/copy.c	65
src/shared/selinux-util.c	36
src/basic/mallinfo-util.h	1
src/basic/tmpfile-util.c	32
src/basic/random-util.h	1
src/basic/random-util.c	15
src/fundamental/sha256-fundamental.c	8
src/basic/sync-util.c	15
src/basic/gcrypt-util.h	1
src/basic/uid-classification.c	16
src/shared/acl-util.c	18
src/basic/dirent-util.c	9
src/libsystemd/sd-journal/journal-vacuum.c	32
src/basic/mkdir.h	1
src/basic/mkdir.c	20
src/libsystemd/sd-journal/sd-journal.c	122
src/basic/filesystems.c	6
src/basic/syslog-util.c	5
src/shared/rm-rf.h	1
src/shared/rm-rf.c	46
src/shared/btrfs-util.c	41
src/shared/btrfs-util.h	2
src/libsystemd/sd-journal/journal-authenticate.c	29
src/libsystemd/sd-journal/fsprg.c	26
src/basic/gcrypt-util.c	7
src/basic/macro.h	1
src/basic/siphash24.c	8
src/libsystemd/sd-journal/lookup3.h	1
src/libsystemd/sd-journal/lookup3.c	2
src/basic/compress.c	44
src/basic/compress.h	3
src/journal/journald-sync.c	16
src/journal/journald-varlink.c	8
src/libsystemd/sd-varlink/sd-varlink.c	36
src/libsystemd/sd-json/sd-json.c	67
src/libsystemd/sd-varlink/sd-varlink-idl.c	24
src/basic/memstream-util.c	6
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9

Fuzzer: fuzz-manager-serialize

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5048	70.3%
gold	[1:9]	75	1.04%
yellow	[10:29]	9	0.12%
greenyellow	[30:49]	3	0.04%
lawngreen	50+	2042	28.4%
All colors	7177	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
693	4051	manager_varlink_send_managed_oom_update	call site: 04051	manager_varlink_managed_oom_connect
527	5610	netlink_open_family	call site: 05610	fw_nftables_init_family
291	4768	pidref_is_remote	call site: 04768	json_variant_new_pidref
196	2817	random_bytes	call site: 02817	write_string_stream_full
167	5080	on_dev_null	call site: 05080	sd_json_build
137	5249	close_many	call site: 05249	sd_varlink_send
124	2558	uid_is_valid	call site: 02558	mkdirat_safe_internal
116	891	prioq_remove	call site: 00891	remove_recursive
111	6162	memdup	call site: 06162	fw_nftables_init_family
110	2090	skip_leading_chars	call site: 02090	server_name_new
94	1992	shuffle_up	call site: 01992	manager_network_read_link_servers
83	2231	sd_event_add_defer	call site: 02231	manager_flush_server_names

Runtime coverage analysis

Covered functions

996

Functions that are reachable but not covered

561

Reachable functions

758

Percentage of reachable functions covered

25.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/core/fuzz-manager-serialize.c	15
src/fuzz/fuzz.h	5
src/basic/log.c	59
src/basic/process-util.c	32
src/basic/argv-util.c	4
src/basic/parse-util.c	16
src/basic/parse-util.h	6
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	19
src/basic/virt.c	20
src/basic/fileio.h	8
src/basic/fileio.c	105
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	44
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	15
src/basic/stat-util.c	22
src/basic/stat-util.h	1
src/basic/fs-util.h	6
src/basic/fs-util.c	42
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	29
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	34
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	34
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	7
src/basic/memory-util.h	7
src/basic/strv.h	2
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	3
src/basic/hexdecoct.c	15
src/basic/initrd-util.c	4
src/basic/env-util.c	18
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	3
src/basic/time-util.c	13
src/basic/time-util.h	4
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	147
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	13
src/basic/hashmap.c	58
src/basic/set.h	7
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	2
src/basic/psi-util.c	3
src/basic/cgroup-util.c	73
src/basic/string-util.h	4
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	3
src/libsystemd/sd-id128/sd-id128.c	9
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	7
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	8
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	3
src/basic/memfd-util.c	11
src/basic/utf8.c	12
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/core/manager.c	44
src/shared/fdset.c	24
src/core/manager-serialize.c	93
src/shared/serialize.c	40
src/basic/mkdir.h	1
src/basic/mkdir.c	20
src/basic/chase.c	52
src/basic/user-util.c	17
src/core/show-status.h	1
src/shared/watchdog.c	49
src/basic/ratelimit.c	5
src/basic/tmpfile-util.c	22
src/basic/random-util.h	1
src/basic/random-util.c	15
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/basic/sync-util.c	13
src/basic/escape.h	4
src/core/dynamic-user.c	19
src/core/execute.c	31
src/core/varlink.c	40
src/libsystemd/sd-varlink/varlink-util.c	8
src/libsystemd/sd-varlink/sd-varlink.c	85
src/shared/varlink-serialize.c	19
src/libsystemd/sd-bus/bus-error.c	15
src/basic/errno-list.c	3
src/basic/unit-name.c	39
src/shared/unit-file.c	9
src/basic/siphash24.c	10
src/basic/unaligned.h	1
src/basic/siphash24.h	1
src/core/unit.c	122
src/basic/unit-name.h	1
src/shared/unit-file.h	1
src/core/cgroup.c	97
src/shared/numa-util.h	2
src/shared/cpu-set-util.h	2
src/basic/process-util.h	2
src/core/kill.c	1
src/libsystemd/sd-bus/bus-track.c	5
src/core/unit.h	4
src/core/unit-dependency-atom.c	1
src/libsystemd/sd-json/sd-json.c	163
src/basic/ordered-set.h	7
src/libsystemd/sd-json/json-util.c	15
src/basic/pidref.h	1
src/basic/pidref.c	6
src/basic/in-addr-util.h	4
src/basic/ether-addr-util.h	2
src/basic/ether-addr-util.c	3
src/basic/memstream-util.c	6
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9
src/libsystemd/sd-varlink/sd-varlink-idl.c	24
src/core/unit-serialize.c	56
src/core/job.c	35
src/basic/user-util.h	2
src/shared/firewall-util.c	8
src/shared/firewall-util-nft.c	46
src/libsystemd/sd-netlink/netlink-message-nfnl.c	34
src/libsystemd/sd-netlink/netlink-util.c	18
src/libsystemd/sd-netlink/sd-netlink.c	31
src/libsystemd/sd-netlink/netlink-socket.c	44
src/libsystemd/sd-netlink/netlink-message.c	48
src/libsystemd/sd-netlink/netlink-types.c	13
src/libsystemd/sd-netlink/netlink-types-rtnl.c	1
src/libsystemd/sd-netlink/netlink-types-nfnl.c	4
src/libsystemd/sd-netlink/netlink-genl.c	6
src/libsystemd/sd-netlink/netlink-types-genl.c	1
src/libsystemd/sd-netlink/netlink-types-sdnl.c	1
src/libsystemd/sd-netlink/netlink-message-rtnl.c	15
src/libsystemd/sd-netlink/netlink-internal.h	2
src/basic/ordered-set.c	3
src/basic/prioq.h	1
src/shared/async.c	6
src/shared/bpf-link.c	5
src/shared/bpf-program.c	28
src/core/bpf-firewall.c	6
src/basic/procfs-util.c	14
src/core/bpf-socket-bind.c	8
src/core/bpf-restrict-ifaces.c	7
src/core/dbus.c	8
src/libsystemd/sd-bus/bus-internal.c	4
src/basic/procfs-util.h	1
src/shared/bpf-dlopen.c	1
src/libsystemd/sd-bus/sd-bus.c	8

Fuzzer: fuzz-bus-message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1259	58.2%
gold	[1:9]	55	2.54%
yellow	[10:29]	21	0.97%
greenyellow	[30:49]	2	0.09%
lawngreen	50+	823	38.1%
All colors	2160	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
295	239	strempty	call site: 00239	pid_get_cmdline_strv
120	536	memcpy_safe	call site: 00536	read_full_file
95	24	should_parse_proc_cmdline	call site: 00024	proc_cmdline_parse
75	1407	sd_bus_creds_get_user_unit	call site: 01407	cg_shift_path
73	123	startswith	call site: 00123	read_line
70	1713	json_transform_one	call site: 01713	json_variant_new_fd_info
59	1307	strv_find	call site: 01307	cg_path_get_owner_uid
51	1253	sd_bus_creds_get_owner_uid	call site: 01253	cg_shift_path
43	769	log_open	call site: 00769	log_open_syslog
38	200	isatty_safe	call site: 00200	get_proc_field
29	657	secure_getenv_bool	call site: 00657	in_initrd
26	1536	dump_capabilities	call site: 01536	cap_last_cap

Runtime coverage analysis

Covered functions

259

Functions that are reachable but not covered

422

Reachable functions

611

Percentage of reachable functions covered

30.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd/sd-bus/fuzz-bus-message.c	14
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	15
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	67
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	15
src/basic/stat-util.c	16
src/basic/stat-util.h	1
src/basic/fs-util.h	2
src/basic/fs-util.c	19
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	14
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	27
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	13
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	3
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	5
src/basic/time-util.h	2
src/libsystemd/sd-bus/sd-bus.c	7
src/libsystemd/sd-bus/bus-message.c	79
src/libsystemd/sd-bus/bus-message.h	5
src/libsystemd/sd-bus/bus-signature.c	4
src/libsystemd/sd-bus/bus-type.c	1
src/basic/utf8.h	1
src/basic/utf8.c	7
src/libsystemd/sd-bus/bus-internal.c	2
src/basic/memstream-util.c	2
src/libsystemd/sd-bus/bus-dump.c	46
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/libsystemd/sd-bus/bus-creds.c	12
src/basic/cgroup-util.c	48
src/basic/string-util.h	4
src/basic/unit-name.c	8
src/basic/user-util.c	26
src/basic/nulstr-util.h	1
src/basic/capsule-util.c	3
src/basic/login-util.c	2
src/basic/capability-util.c	4
src/basic/cap-list.c	3
src/libsystemd/sd-bus/bus-dump-json.c	42
src/libsystemd/sd-json/sd-json.c	80
src/libsystemd/sd-json/json-util.c	25
src/basic/mountpoint-util.c	10
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9

Fuzzer: fuzz-journald-audit

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6757	96.8%
gold	[1:9]	6	0.08%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	212	3.03%
All colors	6975	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
988	4837	ordered_hashmap_free	call site: 04837	manager_find_journal
810	4025	client_context_try_shrink_to	call site: 04025	manager_write_to_journal
706	2352	map_all_fields	call site: 02352	make_userns
705	5826	prioq_peek	call site: 05826	manager_find_journal
677	3322	manager_dispatch_message	call site: 03322	manager_dispatch_message_real
568	1745	timespec_load	call site: 01745	manager_network_read_link_servers
435	6536	greedy_realloc	call site: 06536	manager_find_journal
370	868	event_free	call site: 00868	remove_recursive
364	1376	sd_event_default	call site: 01376	sd_event_add_memory_pressure
208	320	endswith	call site: 00320	pid_get_cmdline_strv
194	121	startswith	call site: 00121	get_proc_field
185	3111	strlen_ptr	call site: 03111	write_string_file

Runtime coverage analysis

Covered functions

93

Functions that are reachable but not covered

1352

Reachable functions

1420

Percentage of reachable functions covered

4.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/journal/fuzz-journald-audit.c	7
src/fuzz/fuzz.h	3
src/basic/log.c	61
src/basic/process-util.c	97
src/basic/argv-util.c	18
src/basic/parse-util.c	15
src/basic/parse-util.h	6
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	24
src/basic/virt.c	20
src/basic/fileio.h	10
src/basic/fileio.c	102
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	36
src/boot/efi-string.c	6
src/basic/errno-util.h	5
src/basic/terminal-util.c	7
src/basic/stat-util.c	25
src/basic/stat-util.h	1
src/basic/fs-util.h	6
src/basic/fs-util.c	66
src/fundamental/string-util-fundamental.h	6
src/basic/fd-util.c	55
src/basic/label.c	3
src/basic/btrfs.c	18
src/basic/path-util.c	40
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	15
src/basic/namespace-util.c	19
src/basic/memory-util.c	3
src/basic/string-util.c	22
src/boot/util.c	8
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	7
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	4
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	3
src/basic/socket-util.h	3
src/basic/time-util.c	6
src/basic/time-util.h	4
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	159
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	36
src/basic/hashmap.h	14
src/basic/hashmap.c	56
src/basic/set.h	7
src/basic/glob-util.c	5
src/basic/mempool.c	10
src/basic/signal-util.c	10
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	58
src/basic/string-util.h	4
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	5
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	13
src/basic/io-util.c	7
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	4
src/basic/memfd-util.c	11
src/basic/utf8.c	17
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/journal/fuzz-journald.c	4
src/journal/journald-audit.c	36
src/shared/mount-util.c	20
src/basic/namespace-util.h	1
src/basic/process-util.h	3
src/basic/pidref.h	2
src/basic/pidref.c	18
src/basic/pidfd-util.c	25
src/basic/raw-clone.h	3
src/basic/capability-util.c	10
src/basic/rlimit-util.c	5
src/boot/efi-log.c	6
src/basic/mkdir.c	20
src/basic/chase.c	67
src/basic/user-util.c	37
src/basic/tmpfile-util.c	32
src/basic/random-util.h	1
src/basic/random-util.c	15
src/fundamental/sha256-fundamental.c	8
src/basic/sync-util.c	15
src/journal/journald-manager.c	143
src/journal/journald-rate-limit.c	21
src/fundamental/logarithm.h	1
src/journal/journald-context.c	87
src/basic/user-util.h	2
src/basic/gunicode.c	2
src/basic/capability-util.h	1
src/basic/audit-util.c	13
src/journal/journald-client.c	15
src/basic/unit-name.c	9
src/basic/xattr-util.h	2
src/basic/xattr-util.c	37
src/basic/nulstr-util.h	1
src/shared/pcre2-util.c	16
src/basic/login-util.c	2
src/basic/capsule-util.c	3
src/basic/utf8.h	1
src/basic/unaligned.h	1
src/libsystemd/sd-journal/journal-file.c	144
src/basic/procfs-util.c	9
src/libsystemd/sd-event/event-util.c	3
src/journal/journald-socket.c	24
src/shared/journal-file-util.c	48
src/libsystemd/sd-journal/journal-file.h	8
src/libsystemd/sd-journal/mmap-cache.c	41
src/basic/sigbus.c	6
src/shared/copy.c	65
src/shared/selinux-util.c	36
src/basic/mallinfo-util.h	1
src/basic/gcrypt-util.h	1
src/basic/uid-classification.c	16
src/shared/acl-util.c	18
src/basic/dirent-util.c	9
src/libsystemd/sd-journal/journal-vacuum.c	32
src/basic/mkdir.h	1
src/libsystemd/sd-journal/sd-journal.c	122
src/basic/filesystems.c	6
src/basic/syslog-util.c	5
src/basic/prioq.h	1
src/shared/rm-rf.h	1
src/shared/rm-rf.c	46
src/shared/btrfs-util.c	41
src/shared/btrfs-util.h	2
src/libsystemd/sd-journal/journal-authenticate.c	29
src/libsystemd/sd-journal/fsprg.c	26
src/basic/gcrypt-util.c	7
src/basic/macro.h	1
src/basic/ratelimit.c	5
src/basic/siphash24.c	8
src/libsystemd/sd-journal/lookup3.h	1
src/libsystemd/sd-journal/lookup3.c	2
src/basic/compress.c	44
src/basic/compress.h	3

Fuzzer: fuzz-dhcp-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1940	61.3%
gold	[1:9]	72	2.27%
yellow	[10:29]	11	0.34%
greenyellow	[30:49]	10	0.31%
lawngreen	50+	1128	35.6%
All colors	3161	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
189	2365	statx_inode_same	call site: 02365	chaseat_needs_absolute
121	922	event_free	call site: 00922	remove_recursive
82	27	should_parse_proc_cmdline	call site: 00027	proc_cmdline_parse
79	403	xopenat_full	call site: 00403	pid_get_cmdline_strv
77	1215	hashmap_get	call site: 01215	event_gc_inode_data
66	1096	_hashmap_get	call site: 01096	dir_cleanup
63	1563	dhcp_option_parse	call site: 01563	parse_roothashsig_option
63	2601	random_bytes	call site: 02601	fallback_random_bytes
51	2300	mkdirat_parents_internal	call site: 02300	mkdirat_safe_internal
49	1164	_hashmap_contains	call site: 01164	xopenat
48	485	page_size	call site: 00485	pid_get_comm
43	136	xfopenat_full	call site: 00136	xfopenat_unix_socket

Runtime coverage analysis

Covered functions

418

Functions that are reachable but not covered

473

Reachable functions

768

Percentage of reachable functions covered

38.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd-network/fuzz-dhcp-server.c	26
src/basic/sparse-endian.h	3
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	18
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	7
src/basic/fileio.c	70
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	15
src/basic/stat-util.c	23
src/basic/stat-util.h	1
src/basic/fs-util.h	5
src/basic/fs-util.c	42
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	20
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	34
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	10
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	2
src/basic/time-util.c	6
src/basic/time-util.h	4
src/basic/tmpfile-util.c	29
src/libsystemd-network/sd-dhcp-server.c	81
src/libsystemd/sd-event/sd-event.c	67
src/basic/prioq.c	7
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	9
src/basic/hashmap.c	48
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/in-addr-util.c	4
src/libsystemd-network/sd-dhcp-server-lease.c	53
src/libsystemd-network/sd-dhcp-client-id.c	8
src/libsystemd-network/dhcp-option.c	12
src/veritysetup/veritysetup.c	27
src/basic/hexdecoct.h	2
src/libsystemd/sd-id128/sd-id128.c	8
src/shared/fstab-util.c	10
src/shared/device-nodes.c	7
src/basic/utf8.c	7
src/basic/siphash24.c	5
src/basic/unaligned.h	1
src/libsystemd-network/dhcp-packet.c	9
src/libsystemd-network/network-common.c	2
src/basic/in-addr-util.h	1
src/basic/ordered-set.h	2
src/libsystemd-network/test-dhcp-client.c	6
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	7
src/basic/io-util.h	1
src/fundamental/logarithm.h	1
src/libsystemd/sd-json/sd-json.c	130
src/libsystemd/sd-json/json-util.h	2
src/basic/mkdir.c	20
src/basic/chase.c	52
src/basic/user-util.c	15
src/basic/random-util.h	1
src/basic/random-util.c	15
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9

Fuzzer: fuzz-udev-database

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	674	67.7%
gold	[1:9]	16	1.60%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	305	30.6%
All colors	995	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
142	336	path_simplify_full	call site: 00336	pid_get_cmdline_strv
94	177	xfopenat_full	call site: 00177	get_proc_field
90	481	page_size	call site: 00481	read_full_file
57	48	safe_atou_full	call site: 00048	proc_cmdline_parse
43	132	xfopenat_full	call site: 00132	xfopenat_unix_socket
43	768	log_open	call site: 00768	log_open_syslog
40	606	read_full_stream_full	call site: 00606	unbase64mem_full
38	647	read_full_stream_full	call site: 00647	strv_split_full
18	282	path_find_first_component	call site: 00282	path_find_last_component
9	692	log_parse_environment_variables	call site: 00692	log_set_max_level_from_string
9	814	log_open	call site: 00814	open_terminal
8	304	filename_part_is_valid	call site: 00304	path_extract_directory

Runtime coverage analysis

Covered functions

167

Functions that are reachable but not covered

283

Reachable functions

371

Percentage of reachable functions covered

23.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-udev-database.c	9
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/basic/tmpfile-util.c	6
src/libsystemd/sd-device/sd-device.c	37
src/basic/string-util.h	2
src/basic/set.h	2
src/basic/hashmap.c	30
src/basic/mempool.c	10
src/basic/hashmap.h	4
src/libsystemd/sd-device/device-internal.h	1

Fuzzer: fuzz-varlink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1902	64.4%
gold	[1:9]	56	1.89%
yellow	[10:29]	2	0.06%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	993	33.6%
All colors	2953	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	894	prioq_remove	call site: 00894	remove_recursive
132	557	strv_length	call site: 00557	read_full_file
98	260	xopenat_full	call site: 00260	btrfs_subvol_make_fallback
96	126	startswith	call site: 00126	get_proc_field
79	403	xopenat_full	call site: 00403	pid_get_cmdline_strv
71	2710	process_watchdog	call site: 02710	sd_notify
66	1046	_hashmap_get	call site: 01046	dir_cleanup
53	1165	hashmap_get	call site: 01165	event_gc_signal_data
53	1509	hashmap_put	call site: 01509	inode_data_realize_watch
52	485	page_size	call site: 00485	pid_get_comm
51	1922	varlink_clear	call site: 01922	sigterm_wait
43	772	log_open	call site: 00772	log_open_syslog

Runtime coverage analysis

Covered functions

454

Functions that are reachable but not covered

529

Reachable functions

779

Percentage of reachable functions covered

32.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-varlink.c	25
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	32
src/basic/argv-util.c	5
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	70
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	23
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	15
src/basic/stat-util.c	19
src/basic/stat-util.h	1
src/basic/fs-util.h	4
src/basic/fs-util.c	19
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	20
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	27
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	6
src/basic/string-util.c	13
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	6
src/basic/time-util.h	3
src/libsystemd/sd-event/sd-event.c	189
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	6
src/basic/hashmap.c	49
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/libsystemd/sd-varlink/sd-varlink.c	110
src/basic/inotify-util.c	4
src/shared/dns-domain.c	10
src/basic/hostname-util.c	2
src/basic/user-util.c	1
src/basic/pidref.c	13
src/basic/pidref.h	1
src/basic/pidfd-util.c	13
src/libsystemd/sd-json/sd-json.c	67
src/basic/memstream-util.c	6
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9
src/fundamental/logarithm.h	1
src/basic/prioq.h	1
src/shared/tests.c	5
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/basic/process-util.h	1
src/libsystemd/sd-daemon/sd-daemon.c	38
src/basic/iovec-util.c	3
src/basic/ratelimit.c	5

Fuzzer: fuzz-bus-match

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	812	70.6%
gold	[1:9]	13	1.13%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	325	28.2%
All colors	1150	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
356	123	startswith	call site: 00123	pid_get_cmdline_strv
150	536	memcpy_safe	call site: 00536	read_full_file
95	24	should_parse_proc_cmdline	call site: 00024	proc_cmdline_parse
48	482	page_size	call site: 00482	pid_get_comm
43	769	log_open	call site: 00769	log_open_syslog
19	749	stderr_is_journal	call site: 00749	extract_first_word
13	1066	hashmap_iterate_entry	call site: 01066
9	693	log_parse_environment_variables	call site: 00693	log_set_max_level_from_string
9	815	log_open	call site: 00815	open_terminal
7	1058	_hashmap_free	call site: 01058	_hashmap_first_key_and_value
6	1004	hashmap_base_new	call site: 01004	BUS_MATCH_CAN_HASH
5	1094	hashmap_iterate_in_internal_order	call site: 01094	entry_value

Runtime coverage analysis

Covered functions

151

Functions that are reachable but not covered

316

Reachable functions

399

Percentage of reachable functions covered

20.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd/sd-bus/fuzz-bus-match.c	23
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	67
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	14
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/libsystemd/sd-bus/sd-bus.c	6
src/basic/memstream-util.c	6
src/libsystemd/sd-bus/bus-match.c	46
src/libsystemd/sd-bus/bus-internal.c	1
src/basic/stdio-util.h	3
src/basic/hashmap.h	6
src/basic/hashmap.c	45
src/basic/mempool.c	10

Fuzzer: fuzz-ndisc-rs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1770	57.9%
gold	[1:9]	56	1.83%
yellow	[10:29]	7	0.22%
greenyellow	[30:49]	9	0.29%
lawngreen	50+	1210	39.6%
All colors	3052	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
195	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
132	552	strv_length	call site: 00552	read_full_file
111	1039	_hashmap_get	call site: 01039	dir_cleanup
99	887	prioq_remove	call site: 00887	remove_recursive
98	255	xopenat_full	call site: 00255	btrfs_subvol_make_fallback
93	2132	process_watchdog	call site: 02132	arm_watchdog
88	1476	hashmap_base_new	call site: 01476	inode_data_realize_watch
86	1151	event_source_time_prioq_remove	call site: 01151	event_gc_inode_data
79	398	xopenat_full	call site: 00398	pid_get_cmdline_strv
48	480	page_size	call site: 00480	pid_get_comm
43	767	log_open	call site: 00767	log_open_syslog
39	994	memcmp_nn	call site: 00994	fd_fdinfo_mnt_id

Runtime coverage analysis

Covered functions

432

Functions that are reachable but not covered

505

Reachable functions

819

Percentage of reachable functions covered

38.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd-network/fuzz-ndisc-rs.c	32
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	5
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	15
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	68
src/fundamental/string-util-fundamental.c	5
src/basic/socket-util.c	24
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	19
src/basic/stat-util.h	1
src/basic/fs-util.h	4
src/basic/fs-util.c	19
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	14
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	27
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	16
src/boot/util.c	4
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	3
src/basic/alloc-util.h	5
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	6
src/basic/time-util.h	4
src/libsystemd/sd-event/sd-event.c	192
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	7
src/basic/hashmap.c	56
src/basic/set.h	6
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/libsystemd-network/sd-ndisc.c	22
src/libsystemd-network/icmp6-test-util.c	5
src/basic/inotify-util.c	4
src/shared/dns-domain.c	17
src/basic/hostname-util.c	5
src/libsystemd/sd-event/event-util.c	16
src/libsystemd/sd-event/event-util.h	1
src/fundamental/logarithm.h	1
src/basic/prioq.h	1
src/shared/tests.c	5
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/basic/process-util.h	1
src/libsystemd/sd-daemon/sd-daemon.c	38
src/basic/iovec-util.c	3
src/basic/ratelimit.c	5
src/libsystemd-network/sd-radv.c	25
src/libsystemd-network/ndisc-option.h	9
src/libsystemd-network/ndisc-option.c	133
src/basic/ether-addr-util.h	2
src/basic/ether-addr-util.c	1
src/libsystemd-network/sd-dns-resolver.c	13
src/libsystemd-network/network-common.c	3
src/basic/sparse-endian.h	3
src/basic/unaligned.h	2
src/libsystemd-network/icmp6-packet.c	10
src/basic/in-addr-util.c	11
src/shared/dns-domain.h	1
src/basic/string-util.h	2

Fuzzer: fuzz-udev-rules

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	789	70.3%
gold	[1:9]	16	1.42%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	316	28.1%
All colors	1121	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	333	path_startswith_full	call site: 00333	pid_get_cmdline_strv
119	567	free_many	call site: 00567	read_full_file
69	203	read_line_full	call site: 00203	get_proc_field
52	482	page_size	call site: 00482	pid_get_comm
45	1072	udev_rule_line_free	call site: 01072	udev_check_rule_line
43	769	log_open	call site: 00769	log_open_syslog
36	81	cunescape_one	call site: 00081	detect_container
23	1010	strcmp_ptr	call site: 01010	strstrip
22	49	safe_atou_full	call site: 00049	proc_cmdline_parse
19	749	stderr_is_journal	call site: 00749	extract_first_word
18	283	path_find_first_component	call site: 00283	path_find_last_component
18	990	utf8_is_valid_n	call site: 00990	string_is_safe

Runtime coverage analysis

Covered functions

411

Functions that are reachable but not covered

1549

Reachable functions

1863

Percentage of reachable functions covered

16.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/udev/fuzz-udev-rules.c	11
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	17
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	21
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	9
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/basic/tmpfile-util.c	6
src/udev/udev-rules.c	58
src/shared/conf-parser.c	26
src/basic/hashmap.c	24
src/basic/mempool.c	10
src/basic/string-util.h	1
src/basic/utf8.h	1
src/basic/utf8.c	7
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1
src/udev/udev-builtin-keyboard.c	1

Fuzzer: fuzz-network-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2104	57.8%
gold	[1:9]	119	3.26%
yellow	[10:29]	41	1.12%
greenyellow	[30:49]	31	0.85%
lawngreen	50+	1345	36.9%
All colors	3640	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
142	1811	usec_add	call site: 01811	sd_resolve_attach_event
138	2157	utf8_encoded_valid_unichar	call site: 02157	server_name_free
115	571	proc_cmdline_strv_internal	call site: 00571	read_full_file
77	942	statx_mount_same	call site: 00942	dir_cleanup
75	1614	strv_find	call site: 01614	sd_event_set_watchdog
70	868	is_main_thread	call site: 00868	remove_recursive
64	1057	ordered_hashmap_get	call site: 01057	dir_cleanup
63	1690	safe_atou	call site: 01690	vsock_parse_cid
62	1992	ascii_strcasecmp_nn	call site: 01992	manager_network_read_link_servers
56	1555	path_is_normalized	call site: 01555	cg_pid_get_path
55	1329	hashmap_free	call site: 01329	sd_event_unref
49	1123	_hashmap_contains	call site: 01123	xopenat

Runtime coverage analysis

Covered functions

1152

Functions that are reachable but not covered

481

Reachable functions

853

Percentage of reachable functions covered

43.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/network/fuzz-network-parser.c	10
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	15
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	21
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	7
src/basic/fileio.c	69
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	44
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	27
src/basic/stat-util.h	2
src/basic/fs-util.h	4
src/basic/fs-util.c	22
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	21
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	37
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	19
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	4
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	3
src/basic/time-util.c	5
src/basic/time-util.h	3
src/basic/tmpfile-util.c	6
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	141
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	12
src/basic/hashmap.c	58
src/basic/set.h	7
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	21
src/basic/string-util.h	3
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	3
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	19
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	3
src/basic/memfd-util.c	11
src/basic/utf8.c	12
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/network/networkd-network.c	61
src/basic/chase.c	70
src/basic/user-util.c	15
src/shared/conf-parser.c	56
src/basic/conf-files.c	25
src/basic/utf8.h	1
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1
src/network/networkd-route.c	27
src/network/networkd-route-util.c	5
src/basic/sysctl-util.c	13
src/shared/net-condition.c	3
src/shared/condition.c	5
src/network/netdev/netdev.c	2
src/basic/in-addr-util.h	3
src/network/networkd-ipv6-proxy-ndp.c	6
src/network/networkd-ndisc.c	5
src/network/networkd-dhcp-common.c	5
src/network/networkd-dhcp4.c	4
src/network/networkd-radv.c	24
src/basic/ordered-set.h	4
src/shared/conf-parser.h	1
src/network/networkd-bridge-vlan.c	5
src/network/networkd-address.c	41
src/network/networkd-dhcp-server.c	16
src/network/networkd-route-nexthop.c	21
src/network/networkd-nexthop.c	25
src/network/networkd-bridge-fdb.c	8
src/network/networkd-bridge-mdb.c	14
src/basic/ether-addr-util.h	2
src/network/networkd-neighbor.c	15
src/network/networkd-address-label.c	10
src/network/networkd-routing-policy-rule.c	12
src/network/tc/qdisc.c	12
src/network/tc/tclass.c	10
src/shared/netif-sriov.c	13
src/network/networkd-dhcp-server-static-lease.c	12

Fuzzer: fuzz-varlink-idl

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	813	57.5%
gold	[1:9]	33	2.33%
yellow	[10:29]	6	0.42%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	561	39.7%
All colors	1413	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
240	238	strempty	call site: 00238	pid_get_cmdline_strv
132	553	strv_length	call site: 00553	read_full_file
115	122	startswith	call site: 00122	get_proc_field
48	481	page_size	call site: 00481	pid_get_comm
43	768	log_open	call site: 00768	log_open_syslog
35	23	should_parse_proc_cmdline	call site: 00023	proc_cmdline_parse
25	93	strv_split_full	call site: 00093	detect_container
19	748	stderr_is_journal	call site: 00748	extract_first_word
16	1374	varlink_idl_field_consistent	call site: 01374
15	69	extract_first_word	call site: 00069	cunescape_one
12	535	memcpy_safe	call site: 00535	proc_cmdline_filter_pid1_args
9	692	log_parse_environment_variables	call site: 00692	log_set_max_level_from_string

Runtime coverage analysis

Covered functions

163

Functions that are reachable but not covered

289

Reachable functions

389

Percentage of reachable functions covered

25.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-varlink-idl.c	10
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	22
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	67
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	14
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	3
src/basic/alloc-util.h	7
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/libsystemd/sd-varlink/sd-varlink-idl.c	63
src/basic/utf8.c	7
src/basic/memstream-util.c	6
src/basic/utf8.h	1
src/basic/set.h	2
src/basic/hashmap.c	19
src/basic/mempool.c	10

Fuzzer: fuzz-unit-file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1979	58.1%
gold	[1:9]	78	2.29%
yellow	[10:29]	11	0.32%
greenyellow	[30:49]	5	0.14%
lawngreen	50+	1328	39.0%
All colors	3401	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
71	3057	unit_file_find_dropin_paths	call site: 03057	conf_files_list_strv
65	1060	_hashmap_get	call site: 01060	dir_cleanup
63	1816	usec_add	call site: 01816	sd_resolve_attach_event
60	947	statx_mount_same	call site: 00947	dir_cleanup
55	1624	cg_pid_get_path	call site: 01624	sd_event_set_watchdog
55	1703	vsock_parse_cid	call site: 01703	fd_inc_sndbuf
55	2162	utf8_encoded_valid_unichar	call site: 02162	server_name_new
52	2248	sd_event_add_defer	call site: 02248	server_name_free
49	1957	shuffle_down	call site: 01957	dns_name_compare_func
48	1129	set_contains	call site: 01129	xopenat
39	2009	shuffle_up	call site: 02009	manager_network_read_link_servers
38	1499	signal_to_string	call site: 01499	sd_event_add_memory_pressure

Runtime coverage analysis

Covered functions

1484

Functions that are reachable but not covered

974

Reachable functions

1415

Percentage of reachable functions covered

31.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/core/fuzz-unit-file.c	22
src/fuzz/fuzz.h	5
src/basic/fileio.c	70
src/basic/fileio.h	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/fundamental/string-util-fundamental.c	4
src/basic/log.c	59
src/basic/process-util.c	27
src/basic/argv-util.c	4
src/basic/parse-util.c	15
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	20
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/socket-util.c	36
src/boot/efi-string.c	6
src/basic/stat-util.c	23
src/basic/stat-util.h	1
src/basic/fs-util.h	4
src/basic/fs-util.c	22
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	21
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	37
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	20
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	7
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	3
src/basic/time-util.c	5
src/basic/time-util.h	4
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	141
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	9
src/basic/hashmap.c	55
src/basic/set.h	8
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	47
src/basic/string-util.h	4
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	3
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	3
src/basic/memfd-util.c	11
src/basic/utf8.c	12
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/core/unit.c	59
src/basic/unit-name.c	22
src/basic/unit-name.h	1
src/shared/unit-file.h	1
src/core/cgroup.c	31
src/core/execute.c	4
src/shared/numa-util.h	2
src/shared/cpu-set-util.h	2
src/basic/process-util.h	2
src/core/kill.c	1
src/libsystemd/sd-bus/bus-track.c	2
src/shared/conf-parser.c	36
src/basic/utf8.h	1
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1
src/basic/memstream-util.c	2
src/core/unit-serialize.c	49
src/core/unit.h	5
src/core/load-dropin.c	2
src/shared/dropin.c	27
src/basic/chase.c	63
src/basic/user-util.c	15
src/basic/conf-files.c	22
src/shared/condition.c	7
src/core/job.c	13
src/core/manager-dump.c	17

Fuzzer: fuzz-netdev-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1999	68.5%
gold	[1:9]	64	2.19%
yellow	[10:29]	19	0.65%
greenyellow	[30:49]	3	0.10%
lawngreen	50+	831	28.4%
All colors	2916	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
164	1806	sd_id128_get_machine	call site: 01806	sd_resolve_attach_event
121	2158	utf8_encoded_valid_unichar	call site: 02158	server_name_free
115	1058	ordered_hashmap_get	call site: 01058	dir_cleanup
78	1691	safe_atou	call site: 01691	arm_watchdog
75	1615	strv_find	call site: 01615	sd_event_set_watchdog
70	869	is_main_thread	call site: 00869	remove_recursive
60	943	statx_mount_same	call site: 00943	dir_cleanup
59	1985	dns_label_unescape	call site: 01985	manager_network_read_link_servers
56	1556	path_is_normalized	call site: 01556	cg_pid_get_path
55	1330	hashmap_free	call site: 01330	sd_event_unref
47	1387	set_free	call site: 01387	sd_event_set_signal_exit
43	770	log_open	call site: 00770	log_open_syslog

Runtime coverage analysis

Covered functions

930

Functions that are reachable but not covered

439

Reachable functions

676

Percentage of reachable functions covered

35.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/network/fuzz-netdev-parser.c	10
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	21
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	69
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	36
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	27
src/basic/stat-util.h	2
src/basic/fs-util.h	4
src/basic/fs-util.c	22
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	21
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	37
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	19
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	4
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	3
src/basic/time-util.c	5
src/basic/time-util.h	3
src/basic/tmpfile-util.c	6
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	141
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	10
src/basic/hashmap.c	58
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	21
src/basic/string-util.h	3
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	3
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	3
src/basic/memfd-util.c	11
src/basic/utf8.c	12
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/network/netdev/netdev.c	17
src/basic/chase.c	70
src/basic/user-util.c	15
src/shared/conf-parser.c	50
src/basic/conf-files.c	25
src/basic/utf8.h	1
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1
src/shared/condition.c	5

Fuzzer: fuzz-journald-stream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3674	81.0%
gold	[1:9]	99	2.18%
yellow	[10:29]	1	0.02%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	757	16.7%
All colors	4531	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
356	3317	tempfn_build	call site: 03317	write_timestamp_file_atomic
350	2937	stdout_stream_terminate	call site: 02937	sync_req_revalidate
259	4041	fclose_nointr	call site: 04041	sd_varlink_reply
164	4321	on_dev_null	call site: 04321	sd_json_variant_format
150	535	memcpy_safe	call site: 00535	read_full_file
134	1609	cg_pid_get_path	call site: 01609	sd_event_set_watchdog
118	1044	bucket_at	call site: 01044	dir_cleanup
116	893	prioq_remove	call site: 00893	remove_recursive
99	1748	timespec_load	call site: 01748	sd_resolve_attach_event
94	1994	shuffle_up	call site: 01994	manager_network_read_link_servers
87	3820	uid_is_valid	call site: 03820	log_unsafe_transition
79	3702	fchmod_and_chown_with_fallback	call site: 03702	chaseat

Runtime coverage analysis

Covered functions

413

Functions that are reachable but not covered

794

Reachable functions

1024

Percentage of reachable functions covered

22.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/journal/fuzz-journald-stream.c	14
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	5
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	8
src/basic/fileio.c	106
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	40
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	15
src/basic/stat-util.c	23
src/basic/stat-util.h	1
src/basic/fs-util.h	6
src/basic/fs-util.c	47
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	26
src/basic/label.c	3
src/basic/btrfs.c	18
src/basic/path-util.c	35
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	15
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	20
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	3
src/basic/time-util.c	6
src/basic/time-util.h	4
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	227
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	6
src/basic/hashmap.c	48
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	21
src/basic/string-util.h	4
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	3
src/libsystemd/sd-id128/sd-id128.c	10
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	7
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	3
src/basic/memfd-util.c	11
src/basic/utf8.c	11
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/journal/fuzz-journald.c	4
src/journal/journald-stream.c	29
src/basic/random-util.c	15
src/basic/pidfd-util.c	13
src/fundamental/sha256-fundamental.c	8
src/shared/selinux-util.c	36
src/journal/journald-manager.c	19
src/fundamental/logarithm.h	1
src/basic/prioq.h	1
src/shared/tests.c	5
src/basic/process-util.h	1
src/basic/ratelimit.c	5
src/journal/journald-sync.c	14
src/journal/journald-varlink.c	8
src/shared/journal-file-util.c	31
src/libsystemd/sd-journal/journal-file.h	3
src/libsystemd/sd-journal/journal-file.c	23
src/libsystemd/sd-journal/mmap-cache.c	14
src/basic/sigbus.c	6
src/boot/efi-log.c	6
src/shared/copy.c	65
src/basic/mallinfo-util.h	1
src/basic/tmpfile-util.c	32
src/basic/random-util.h	1
src/basic/xattr-util.h	1
src/basic/xattr-util.c	37
src/basic/sync-util.c	15
src/basic/mkdir.c	20
src/basic/chase.c	52
src/basic/user-util.c	15
src/libsystemd/sd-varlink/sd-varlink.c	36
src/libsystemd/sd-json/sd-json.c	67
src/libsystemd/sd-varlink/sd-varlink-idl.c	24
src/basic/memstream-util.c	6
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9
src/journal/journald-context.c	10

Fuzzer: fuzz-dns-packet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1078	65.6%
gold	[1:9]	22	1.33%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.12%
lawngreen	50+	541	32.9%
All colors	1643	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
455	23	should_parse_proc_cmdline	call site: 00023	proc_cmdline_parse
188	1406	dns_answer_add	call site: 01406	base64_append
150	535	memcpy_safe	call site: 00535	read_full_file
85	926	random_bytes	call site: 00926	fallback_random_bytes
48	481	page_size	call site: 00481	pid_get_comm
43	768	log_open	call site: 00768	log_open_syslog
19	748	stderr_is_journal	call site: 00748	extract_first_word
9	692	log_parse_environment_variables	call site: 00692	log_set_max_level_from_string
9	814	log_open	call site: 00814	open_terminal
8	897	reset_direct_storage	call site: 00897
4	733	log_close_journal	call site: 00733	close_nointr
4	741	log_close_syslog	call site: 00741	log_close_console

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

393

Reachable functions

533

Percentage of reachable functions covered

26.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/resolve/fuzz-dns-packet.c	10
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	4
src/basic/terminal-util.c	9
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	2
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	10
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	4
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	21
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	7
src/basic/time-util.h	2
src/resolve/resolved-dns-packet.c	79
src/resolve/resolved-dns-packet.h	6
src/resolve/resolved-dns-question.c	3
src/basic/hashmap.c	46
src/basic/mempool.c	10
src/basic/set.h	2
src/fundamental/logarithm.h	2
src/basic/random-util.c	15
src/basic/io-util.c	7
src/basic/io-util.h	1
src/basic/pidfd-util.c	13
src/basic/mountpoint-util.c	4
src/fundamental/sha256-fundamental.c	8
src/shared/dns-domain.c	9
src/basic/unaligned.h	2
src/basic/sparse-endian.h	2
src/resolve/resolved-dns-rr.c	42
src/resolve/dns-type.c	1
src/resolve/resolved-dns-answer.c	20
src/basic/ordered-set.h	6
src/basic/hashmap.h	7
src/basic/utf8.h	1
src/basic/utf8.c	7
src/shared/bitmap.c	7
src/basic/hostname-util.c	2
src/resolve/resolved-dns-rr.h	1
src/basic/in-addr-util.c	5
src/resolve/resolved-dns-dnssec.c	2
src/basic/hexdecoct.h	1
src/resolve/resolved-dns-answer.h	1

Fuzzer: fuzz-journald-syslog

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2187	94.2%
gold	[1:9]	3	0.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	131	5.64%
All colors	2321	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
568	1746	timespec_load	call site: 01746	manager_network_read_link_servers
370	869	event_free	call site: 00869	remove_recursive
364	1377	sd_event_default	call site: 01377	sd_event_add_memory_pressure
291	236	strempty	call site: 00236	pid_get_cmdline_strv
214	21	should_parse_proc_cmdline	call site: 00021	proc_cmdline_parse
150	533	memcpy_safe	call site: 00533	read_full_file
64	1252	hashmap_free	call site: 01252	_hashmap_clear
43	766	log_open	call site: 00766	log_open_syslog
27	1317	hashmap_free	call site: 01317	sd_event_unref
23	843	sd_event_new	call site: 00843	event_free
19	746	stderr_is_journal	call site: 00746	extract_first_word
9	690	log_parse_environment_variables	call site: 00690	log_set_max_level_from_string

Runtime coverage analysis

Covered functions

102

Functions that are reachable but not covered

458

Reachable functions

504

Percentage of reachable functions covered

9.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/journal/fuzz-journald-syslog.c	3
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	68
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	36
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	19
src/basic/stat-util.h	1
src/basic/fs-util.h	4
src/basic/fs-util.c	19
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	15
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	33
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	19
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	3
src/basic/time-util.c	5
src/basic/time-util.h	3
src/journal/fuzz-journald.c	7
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	141
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	6
src/basic/hashmap.c	48
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	21
src/basic/string-util.h	3
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	3
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	3
src/basic/memfd-util.c	11
src/basic/utf8.c	11
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1

Fuzzer: fuzz-resource-record

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	966	43.7%
gold	[1:9]	71	3.21%
yellow	[10:29]	79	3.58%
greenyellow	[30:49]	32	1.45%
lawngreen	50+	1058	47.9%
All colors	2206	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
240	498	strempty	call site: 00498	pid_get_cmdline_strv
170	285	should_parse_proc_cmdline	call site: 00285	proc_cmdline_parse
132	807	strv_length	call site: 00807	read_full_file
47	2022	dns_packet_append_label	call site: 02022	hashmap_ensure_put
43	1022	log_open	call site: 01022	log_open_syslog
38	459	isatty_safe	call site: 00459	get_proc_field
34	767	cescape_char	call site: 00767	proc_cmdline_filter_pid1_args
23	741	page_size	call site: 00741	pid_get_comm
19	1002	stderr_is_journal	call site: 01002	extract_first_word
16	2072	dns_packet_append_uint8	call site: 02072	dns_packet_truncate
15	1488	sd_json_variant_unsigned	call site: 01488	sd_json_variant_integer
13	1830	print_source	call site: 01830

Runtime coverage analysis

Covered functions

279

Functions that are reachable but not covered

371

Reachable functions

591

Percentage of reachable functions covered

37.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/resolve/fuzz-resource-record.c	15
src/resolve/resolved-dns-rr.c	90
src/resolve/resolved-dns-packet.c	82
src/resolve/resolved-dns-packet.h	3
src/boot/efi-string.c	6
src/basic/memory-util.h	7
src/shared/dns-domain.c	12
src/basic/unaligned.h	2
src/basic/sparse-endian.h	2
src/resolve/dns-type.c	1
src/basic/string-util.c	10
src/basic/alloc-util.c	4
src/basic/utf8.h	1
src/basic/utf8.c	7
src/shared/bitmap.c	11
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	67
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/basic/errno-util.h	3
src/basic/terminal-util.c	17
src/basic/stat-util.c	16
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	2
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/strv.h	4
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	21
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	3
src/basic/time-util.h	2
src/basic/hostname-util.c	2
src/basic/memstream-util.c	2
src/basic/in-addr-util.c	5
src/resolve/resolved-dns-dnssec.c	2
src/basic/hexdecoct.h	1
src/libsystemd/sd-json/sd-json.c	88
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9
src/shared/dns-domain.h	1
src/basic/hashmap.h	3
src/basic/hashmap.c	27
src/basic/mempool.c	10

Fuzzer: fuzz-nspawn-settings

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	755	73.0%
gold	[1:9]	3	0.29%
yellow	[10:29]	3	0.29%
greenyellow	[30:49]	3	0.29%
lawngreen	50+	270	26.1%
All colors	1034	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
168	342	path_simplify_full	call site: 00342	pid_get_cmdline_strv
119	572	free_many	call site: 00572	read_full_file
56	128	startswith	call site: 00128	read_line
43	774	log_open	call site: 00774	log_open_syslog
35	208	read_line_full	call site: 00208	get_proc_field
32	244	strempty	call site: 00244	fd_reopen
31	288	path_find_first_component	call site: 00288	path_extract_directory
30	939	utf8_encoded_valid_unichar	call site: 00939	send_one_fd_sa
26	513	cescape_char	call site: 00513	strv_parse_nulstr_full
26	884	strstrip	call site: 00884	sd_journal_sendv
25	99	strv_split_full	call site: 00099	detect_container
20	911	string_is_safe	call site: 00911	memfd_new_full

Runtime coverage analysis

Covered functions

248

Functions that are reachable but not covered

383

Reachable functions

471

Percentage of reachable functions covered

18.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/nspawn/fuzz-nspawn-settings.c	7
src/fuzz/fuzz.h	5
src/basic/fileio.c	66
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	20
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	19
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	10
src/boot/util.c	2
src/basic/nulstr-util.c	7
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/nspawn/nspawn-settings.c	5
src/shared/conf-parser.c	36
src/basic/string-util.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	1
src/basic/memfd-util.c	11
src/basic/utf8.c	12
src/basic/utf8.h	1
src/basic/nulstr-util.h	1
src/test/test-replace-var.c	1

Fuzzer: src/fuzz/fuzz-compress.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	500	51.0%
gold	[1:9]	56	5.72%
yellow	[10:29]	1	0.10%
greenyellow	[30:49]	10	1.02%
lawngreen	50+	412	42.0%
All colors	979	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
63	824	log_setup	call site: 00824	compress_blob
32	888	le64toh	call site: 00888	decompress_startswith
28	925	greedy_realloc	call site: 00925	decompress_startswith_lz4
24	954	unaligned_read_le64	call site: 00954	decompress_startswith_zstd
23	786	timeval_store	call site: 00786	log_open_syslog
22	421	detect_container	call site: 00421	running_in_pidns
18	334	path_simplify_full	call site: 00334	fd_reopen_condition
16	145	sockaddr_un_set_path	call site: 00145	connect_unix_path
16	654	secure_getenv_bool	call site: 00654	parse_boolean
15	381	chattr_full	call site: 00381
13	254	xopenat_full	call site: 00254	btrfs_subvol_make_fallback
12	533	memcpy_safe	call site: 00533	proc_cmdline_filter_pid1_args

Runtime coverage analysis

Covered functions

5034

Functions that are reachable but not covered

198

Reachable functions

340

Percentage of reachable functions covered

41.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-compress.c	12
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	7
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/basic/compress.h	3
src/basic/compress.c	38
src/basic/unaligned.h	1
src/basic/sparse-endian.h	1

Fuzzer: fuzz-fido-id-desc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	766	92.6%
gold	[1:9]	3	0.36%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	58	7.01%
All colors	827	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
662	21	should_parse_proc_cmdline	call site: 00021	proc_cmdline_parse
43	766	log_open	call site: 00766	log_open_syslog
19	746	stderr_is_journal	call site: 00746	extract_first_word
9	690	log_parse_environment_variables	call site: 00690	log_set_max_level_from_string
9	812	log_open	call site: 00812	open_terminal
4	731	log_close_journal	call site: 00731	close_nointr
4	739	log_close_syslog	call site: 00739	log_close_console
2	686	log_parse_environment_variables	call site: 00686	log_set_target
2	706	log_parse_environment_variables	call site: 00706	parse_boolean
2	711	log_parse_environment_variables	call site: 00711	parse_boolean
2	716	log_parse_environment_variables	call site: 00716	parse_boolean
2	721	log_parse_environment_variables	call site: 00721	parse_boolean

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

272

Reachable functions

295

Percentage of reachable functions covered

7.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/udev/fido_id/fuzz-fido-id-desc.c	4
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	65
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2

Fuzzer: fuzz-calendarspec

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1183	72.6%
gold	[1:9]	44	2.70%
yellow	[10:29]	29	1.78%
greenyellow	[30:49]	4	0.24%
lawngreen	50+	368	22.6%
All colors	1628	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	1199	calendar_spec_next_usec_impl	call site: 01199	safe_fork
289	239	verify_stat_at	call site: 00239	pid_get_cmdline_strv
150	534	memcpy_safe	call site: 00534	read_full_file
106	121	startswith	call site: 00121	get_proc_field
95	22	should_parse_proc_cmdline	call site: 00022	proc_cmdline_parse
43	767	log_open	call site: 00767	log_open_syslog
19	747	stderr_is_journal	call site: 00747	extract_first_word
9	691	log_parse_environment_variables	call site: 00691	log_set_max_level_from_string
9	813	log_open	call site: 00813	open_terminal
6	859	loop_read	call site: 00859	fd_wait_for_event
5	1089	calendar_spec_to_string	call site: 01089	memstream_finalize
4	740	log_close_syslog	call site: 00740	log_close_console

Runtime coverage analysis

Covered functions

96

Functions that are reachable but not covered

406

Reachable functions

488

Percentage of reachable functions covered

16.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-calendarspec.c	16
src/fuzz/fuzz.h	3
src/basic/log.c	61
src/basic/process-util.c	83
src/basic/argv-util.c	18
src/basic/parse-util.c	16
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	67
src/fundamental/string-util-fundamental.c	6
src/basic/socket-util.c	14
src/boot/efi-string.c	5
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	46
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	2
src/basic/socket-util.h	2
src/basic/time-util.c	24
src/basic/time-util.h	3
src/shared/calendarspec.c	73
src/basic/io-util.c	7
src/basic/io-util.h	1
src/basic/memstream-util.c	6
src/basic/string-util.h	2
src/basic/process-util.h	1
src/basic/pidref.h	2
src/basic/pidref.c	16
src/basic/pidfd-util.c	24
src/basic/mountpoint-util.c	9
src/basic/signal-util.c	8
src/basic/raw-clone.h	3
src/basic/capability-util.c	2
src/basic/rlimit-util.c	5
src/boot/efi-log.c	1

Fuzzer: fuzz-hostname-setup

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	802	85.0%
gold	[1:9]	3	0.31%
yellow	[10:29]	34	3.60%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	11.0%
All colors	943	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
286	403	xopenat_full	call site: 00403	pid_get_cmdline_strv
155	27	should_parse_proc_cmdline	call site: 00027	proc_cmdline_parse
98	260	xopenat_full	call site: 00260	btrfs_subvol_make_fallback
72	856	loop_read	call site: 00856	sd_id128_from_string
43	772	log_open	call site: 00772	log_open_syslog
26	228	xopenat_full	call site: 00228	fd_reopen
23	379	xopenat_full	call site: 00379	chattr_fd
19	752	stderr_is_journal	call site: 00752	extract_first_word
16	206	read_line_full	call site: 00206	get_proc_field
10	359	xopenat_full	call site: 00359	fd_reopen
9	696	log_parse_environment_variables	call site: 00696	log_set_max_level_from_string
9	818	log_open	call site: 00818	open_terminal

Runtime coverage analysis

Covered functions

61

Functions that are reachable but not covered

279

Reachable functions

327

Percentage of reachable functions covered

14.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-hostname-setup.c	5
src/fuzz/fuzz.h	5
src/basic/fileio.c	67
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/shared/hostname-setup.c	15
src/libsystemd/sd-id128/sd-id128.c	5
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/basic/siphash24.c	5
src/basic/unaligned.h	1
src/basic/sparse-endian.h	1
src/basic/hostname-util.c	8

Fuzzer: fuzz-systemctl-parse-argv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5781	76.1%
gold	[1:9]	239	3.14%
yellow	[10:29]	121	1.59%
greenyellow	[30:49]	19	0.25%
lawngreen	50+	1433	18.8%
All colors	7593	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	5515	bus_error_strerror	call site: 05515	bus_process_object
604	6477	sd_bus_error_free	call site: 06477	object_find_and_run
203	7389	static_destruct_impl	call site: 07389	rm_rf_children
184	6191	pidref_done	call site: 06191	sd_bus_call_method
140	336	path_extract_directory	call site: 00336	pid_get_cmdline_strv
133	2303	ERRNO_IS_NEG_TRANSIENT	call site: 02303	pager_fallback
131	4341	_hashmap_remove	call site: 04341	sd_event_source_set_priority
129	4084	bucket_at	call site: 04084	dir_cleanup
121	2036	close_many	call site: 02036	pidref_set_self
119	2682	snprintf_ok	call site: 02682	format_timestamp_style
117	1917	pidref_safe_fork_full	call site: 01917	pidref_set_pid
109	574	read_full_file_full	call site: 00574	strv_split_full

Runtime coverage analysis

Covered functions

574

Functions that are reachable but not covered

1021

Reachable functions

1465

Percentage of reachable functions covered

30.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/systemctl/fuzz-systemctl-parse-argv.c	18
src/fuzz/fuzz.h	3
src/basic/log.c	61
src/basic/process-util.c	100
src/basic/argv-util.c	20
src/basic/parse-util.c	19
src/basic/parse-util.h	6
src/basic/proc-cmdline.c	21
src/basic/strv.c	26
src/basic/extract-word.c	8
src/basic/escape.c	18
src/basic/virt.c	20
src/basic/fileio.h	9
src/basic/fileio.c	103
src/fundamental/string-util-fundamental.c	5
src/basic/socket-util.c	38
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	32
src/basic/stat-util.c	30
src/basic/stat-util.h	2
src/basic/fs-util.h	6
src/basic/fs-util.c	33
src/fundamental/string-util-fundamental.h	7
src/basic/fd-util.c	57
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	35
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	29
src/basic/memory-util.c	3
src/basic/string-util.c	39
src/boot/util.c	4
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	8
src/basic/strv.h	4
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	3
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	7
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	3
src/basic/socket-util.h	3
src/basic/time-util.c	67
src/basic/time-util.h	6
src/basic/nulstr-util.h	1
src/systemctl/systemctl.c	57
src/systemctl/systemctl-compat-halt.c	15
src/shared/utmp-wtmp.c	6
src/shared/utmp-wtmp.h	1
src/shared/pretty-print.c	12
src/basic/ansi-color.h	3
src/basic/ansi-color.c	11
src/shared/reboot-util.c	22
src/basic/utf8.h	2
src/basic/utf8.c	16
src/basic/mkdir.c	20
src/basic/chase.c	61
src/basic/mountpoint-util.c	36
src/basic/user-util.c	46
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/basic/tmpfile-util.c	22
src/basic/random-util.h	1
src/basic/random-util.c	15
src/basic/io-util.c	16
src/basic/io-util.h	2
src/basic/pidfd-util.c	25
src/fundamental/sha256-fundamental.c	8
src/basic/string-util.h	8
src/basic/sync-util.c	13
src/systemctl/systemctl-compat-shutdown.c	14
src/systemctl/systemctl-sysv-compat.c	8
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	4
src/basic/memfd-util.c	12
src/systemctl/systemctl-compat-telinit.c	13
src/systemctl/systemctl-compat-runlevel.c	11
src/shared/pager.c	50
src/basic/process-util.h	1
src/basic/pidref.h	2
src/basic/pidref.c	23
src/basic/signal-util.c	12
src/basic/raw-clone.h	3
src/basic/capability-util.c	6
src/basic/rlimit-util.c	5
src/boot/efi-log.c	1
src/libsystemd/sd-login/sd-login.c	3
src/basic/cgroup-util.c	38
src/basic/unit-name.c	7
src/shared/copy.h	1
src/shared/copy.c	39
src/basic/build.c	11
src/basic/capsule-util.c	3
src/shared/parse-argument.c	18
src/shared/image-policy.c	22
src/shared/format-table.c	78
src/basic/stdio-util.h	3
src/basic/format-util.h	1
src/basic/format-util.c	5
src/basic/strxcpyx.h	1
src/basic/strxcpyx.c	5
src/basic/format-ifname.c	7
src/basic/in-addr-util.c	5
src/libsystemd/sd-id128/sd-id128.c	7
src/basic/user-util.h	3
src/basic/devnum-util.h	2
src/basic/gunicode.c	2
src/shared/output-mode.h	1
src/systemctl/systemctl-logind.c	9
src/resolve/resolvectl.c	6
src/libsystemd/sd-bus/sd-bus.c	226
src/libsystemd/sd-bus/bus-socket.c	156
src/libsystemd/sd-daemon/sd-daemon.c	6
src/libsystemd/sd-bus/bus-message.c	164
src/libsystemd/sd-bus/bus-internal.c	24
src/basic/escape.h	1
src/libsystemd/sd-bus/bus-container.c	19
src/basic/hostname-util.c	6
src/libsystemd/sd-event/sd-event.c	83
src/basic/prioq.c	14
src/shared/dns-domain.c	10
src/tmpfiles/tmpfiles.c	65
src/basic/hashmap.h	12
src/basic/hashmap.c	50
src/basic/set.h	5
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/inotify-util.c	4
src/basic/af-list.c	1
src/libsystemd/sd-bus/bus-kernel.c	6
src/libsystemd/sd-bus/bus-creds.c	45
src/libsystemd/sd-bus/bus-message.h	6
src/libsystemd/sd-bus/bus-type.c	1
src/libsystemd/sd-bus/bus-signature.c	4
src/libsystemd/sd-bus/bus-slot.c	18
src/basic/prioq.h	1
src/libsystemd/sd-bus/bus-control.c	46
src/libsystemd/sd-bus/bus-convenience.c	41
src/libsystemd/sd-bus/bus-match.c	30
src/libsystemd/sd-bus/bus-objects.c	94
src/libsystemd/sd-bus/bus-error.c	26
src/basic/errno-list.c	5
src/libsystemd/sd-bus/bus-track.c	12
src/basic/log-context.c	11
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/audit-util.c	13
src/basic/devnum-util.c	10
src/shared/pe-binary.c	5
src/shared/bus-log-control-api.c	7
src/shared/cpu-set-util.h	2
src/basic/ordered-set.h	4
src/basic/ordered-set.c	2
src/libsystemd/sd-bus/bus-introspect.c	21
src/basic/memstream-util.c	6
src/shared/bus-locator.c	2
src/basic/string-table.c	1
src/systemctl/systemctl-util.c	2
src/shared/selinux-util.c	2
src/basic/static-destruct.h	1
src/basic/static-destruct.c	4
src/shared/rm-rf.c	39
src/basic/filesystems.c	6
src/shared/btrfs-util.c	41
src/shared/btrfs-util.h	2
src/fundamental/cleanup-fundamental.h	2

Fuzzer: fuzz-execute-serialize

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	877	30.9%
gold	[1:9]	28	0.98%
yellow	[10:29]	46	1.62%
greenyellow	[30:49]	23	0.81%
lawngreen	50+	1858	65.6%
All colors	2832	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
157	320	endswith	call site: 00320	pid_get_cmdline_strv
43	131	xfopenat_full	call site: 00131	xfopenat_unix_socket
43	641	unhexmem_full	call site: 00641	strv_split_full
43	767	log_open	call site: 00767	log_open_syslog
41	2554	serialize_fd_many	call site: 02554	strextendf_with_separator
35	201	read_line_full	call site: 00201	get_proc_field
34	2463	image_policy_to_string	call site: 02463	image_policy_equiv_allow
31	237	strempty	call site: 00237	fd_reopen
31	565	free_many	call site: 00565	read_full_file
26	506	cescape_char	call site: 00506	strv_parse_nulstr_full
23	480	page_size	call site: 00480	pid_get_comm
20	2382	exec_context_serialize	call site: 02382	serialize_item_format

Runtime coverage analysis

Covered functions

484

Functions that are reachable but not covered

323

Reachable functions

643

Percentage of reachable functions covered

49.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/core/fuzz-execute-serialize.c	18
src/fuzz/fuzz.h	5
src/basic/log.c	59
src/basic/process-util.c	27
src/basic/argv-util.c	4
src/basic/parse-util.c	18
src/basic/parse-util.h	8
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	21
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	67
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	6
src/basic/errno-util.h	3
src/basic/terminal-util.c	7
src/basic/stat-util.c	15
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	5
src/basic/fd-util.c	15
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	31
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	21
src/boot/util.c	4
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	3
src/basic/strv.h	3
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	14
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/shared/fdset.c	12
src/basic/hashmap.c	32
src/basic/mempool.c	10
src/core/execute.c	17
src/shared/numa-util.h	2
src/shared/cpu-set-util.h	3
src/core/cgroup.c	17
src/core/execute-serialize.c	183
src/shared/serialize.c	39
src/basic/escape.h	3
src/basic/hexdecoct.h	3
src/basic/rlimit-util.c	7
src/shared/cpu-set-util.c	20
src/core/namespace.c	8
src/core/exec-credential.c	11
src/basic/hashmap.h	8
src/basic/ordered-set.h	3
src/basic/ordered-set.c	3
src/shared/image-policy.c	42
src/basic/string-util.h	1
src/basic/set.h	4
src/shared/open-file.c	20
src/libsystemd/sd-id128/sd-id128.c	5
src/core/dynamic-user.c	20
src/basic/cgroup-util.c	10
src/basic/in-addr-util.h	2
src/basic/in-addr-util.c	16
src/shared/in-addr-prefix-util.c	5
src/basic/sparse-endian.h	1
src/shared/parse-helpers.c	4
src/shared/serialize.h	1
src/basic/af-list.c	1
src/shared/ip-protocol-list.c	3

Fuzzer: fuzz-json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	883	56.8%
gold	[1:9]	27	1.73%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	642	41.3%
All colors	1552	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
295	238	strempty	call site: 00238	pid_get_cmdline_strv
95	23	should_parse_proc_cmdline	call site: 00023	proc_cmdline_parse
73	122	startswith	call site: 00122	read_line
43	768	log_open	call site: 00768	log_open_syslog
38	199	isatty_safe	call site: 00199	get_proc_field
38	647	read_full_stream_full	call site: 00647	strv_split_full
36	1388	sd_json_variant_equal	call site: 01388	sd_json_variant_equal
34	611	read_full_stream_full	call site: 00611	unbase64mem_full
24	553	strv_length	call site: 00553	read_full_file
19	748	stderr_is_journal	call site: 00748	extract_first_word
17	535	memcpy_safe	call site: 00535	proc_cmdline_filter_pid1_args
12	1311	sd_json_variant_dump	call site: 01311	sd_json_variant_dump

Runtime coverage analysis

Covered functions

164

Functions that are reachable but not covered

298

Reachable functions

436

Percentage of reachable functions covered

31.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/fuzz/fuzz-json.c	31
src/fuzz/fuzz.h	5
src/basic/log.c	59
src/basic/process-util.c	24
src/basic/argv-util.c	4
src/basic/parse-util.c	13
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	7
src/basic/fileio.c	68
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	4
src/basic/errno-util.h	3
src/basic/terminal-util.c	15
src/basic/stat-util.c	16
src/basic/stat-util.h	1
src/basic/fs-util.h	1
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	2
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/libsystemd/sd-json/sd-json.c	133
src/basic/utf8.c	7
src/basic/memstream-util.c	2
src/basic/ansi-color.h	1
src/basic/ansi-color.c	9

Fuzzer: fuzz-journald-native

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2183	94.0%
gold	[1:9]	3	0.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	135	5.81%
All colors	2321	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
568	1746	timespec_load	call site: 01746	manager_network_read_link_servers
370	869	event_free	call site: 00869	remove_recursive
364	1377	sd_event_default	call site: 01377	sd_event_add_memory_pressure
291	236	strempty	call site: 00236	pid_get_cmdline_strv
150	533	memcpy_safe	call site: 00533	read_full_file
115	120	startswith	call site: 00120	get_proc_field
95	21	should_parse_proc_cmdline	call site: 00021	proc_cmdline_parse
64	1252	hashmap_free	call site: 01252	_hashmap_clear
43	766	log_open	call site: 00766	log_open_syslog
27	1317	hashmap_free	call site: 01317	sd_event_unref
23	843	sd_event_new	call site: 00843	event_free
19	746	stderr_is_journal	call site: 00746	extract_first_word

Runtime coverage analysis

Covered functions

107

Functions that are reachable but not covered

457

Reachable functions

504

Percentage of reachable functions covered

9.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/journal/fuzz-journald-native.c	3
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	7
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	68
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	36
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	19
src/basic/stat-util.h	1
src/basic/fs-util.h	4
src/basic/fs-util.c	19
src/fundamental/string-util-fundamental.h	4
src/basic/fd-util.c	15
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	33
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	19
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	3
src/basic/time-util.c	5
src/basic/time-util.h	3
src/journal/fuzz-journald.c	7
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	141
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	6
src/basic/hashmap.c	48
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	21
src/basic/string-util.h	3
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	3
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	9
src/basic/io-util.c	6
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	3
src/basic/memfd-util.c	11
src/basic/utf8.c	11
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1

Fuzzer: fuzz-dhcp-server-relay

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1309	83.5%
gold	[1:9]	3	0.19%
yellow	[10:29]	3	0.19%
greenyellow	[30:49]	3	0.19%
lawngreen	50+	249	15.8%
All colors	1567	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
506	26	should_parse_proc_cmdline	call site: 00026	proc_cmdline_parse
382	881	event_free	call site: 00881	remove_recursive
150	538	memcpy_safe	call site: 00538	read_full_file
64	1264	hashmap_free	call site: 01264	_hashmap_clear
43	771	log_open	call site: 00771	log_open_syslog
27	1329	hashmap_free	call site: 01329	sd_event_unref
23	855	sd_event_new	call site: 00855	event_free
19	751	stderr_is_journal	call site: 00751	extract_first_word
13	1541	dhcp_server_send_unicast_raw	call site: 01541	memdup
11	1555	be16toh	call site: 01555	dhcp_packet_checksum
9	695	log_parse_environment_variables	call site: 00695	log_set_max_level_from_string
9	817	log_open	call site: 00817	open_terminal

Runtime coverage analysis

Covered functions

96

Functions that are reachable but not covered

350

Reachable functions

418

Percentage of reachable functions covered

16.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/libsystemd-network/fuzz-dhcp-server-relay.c	18
src/basic/sparse-endian.h	2
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	25
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	5
src/basic/proc-cmdline.c	21
src/basic/strv.c	14
src/basic/extract-word.c	8
src/basic/escape.c	5
src/basic/virt.c	20
src/basic/fileio.h	6
src/basic/fileio.c	68
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	14
src/boot/efi-string.c	6
src/basic/errno-util.h	4
src/basic/terminal-util.c	7
src/basic/stat-util.c	19
src/basic/stat-util.h	1
src/basic/fs-util.h	3
src/basic/fs-util.c	16
src/fundamental/string-util-fundamental.h	1
src/basic/fd-util.c	11
src/basic/label.c	2
src/basic/btrfs.c	18
src/basic/path-util.c	25
src/basic/path-util.h	3
src/basic/chattr-util.h	1
src/basic/chattr-util.c	11
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	6
src/boot/util.c	2
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	4
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	3
src/boot/efi-string.h	2
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	1
src/basic/socket-util.h	2
src/basic/time-util.c	1
src/basic/time-util.h	2
src/libsystemd-network/sd-dhcp-server.c	38
src/libsystemd/sd-event/sd-event.c	62
src/basic/prioq.c	7
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	6
src/basic/hashmap.c	37
src/basic/set.h	4
src/basic/glob-util.c	4
src/basic/mempool.c	1
src/basic/in-addr-util.c	5
src/basic/in-addr-util.h	1
src/libsystemd-network/dhcp-option.c	13
src/libsystemd-network/dhcp-packet.c	3
src/libsystemd-network/test-dhcp-client.c	6

Fuzzer: fuzz-journald-native-fd

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5801	86.7%
gold	[1:9]	84	1.25%
yellow	[10:29]	2	0.02%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	798	11.9%
All colors	6685	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1253	4255	ordered_hashmap_free	call site: 04255	manager_find_journal
607	5509	prioq_peek	call site: 05509	manager_find_journal
575	3261	manager_dispatch_message	call site: 03261	manager_dispatch_message_real
435	6219	greedy_realloc	call site: 06219	manager_find_journal
364	3889	strlen_ptr	call site: 03889	journal_file_offline_close
150	535	memcpy_safe	call site: 00535	read_full_file
147	890	find_item	call site: 00890	remove_recursive
144	2658	client_context_read_log_filter_patterns	call site: 02658	cg_get_xattr
134	1607	cg_pid_get_path	call site: 01607	sd_event_set_watchdog
117	1043	_hashmap_get	call site: 01043	dir_cleanup
98	2216	prioq_put	call site: 02216	manager_flush_server_names
97	1992	shuffle_up	call site: 01992	manager_network_read_link_servers

Runtime coverage analysis

Covered functions

312

Functions that are reachable but not covered

1255

Reachable functions

1509

Percentage of reachable functions covered

16.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/journal/fuzz-journald-native-fd.c	14
src/fuzz/fuzz.h	3
src/basic/log.c	59
src/basic/process-util.c	45
src/basic/argv-util.c	4
src/basic/parse-util.c	14
src/basic/parse-util.h	6
src/basic/proc-cmdline.c	21
src/basic/strv.c	17
src/basic/extract-word.c	8
src/basic/escape.c	24
src/basic/virt.c	20
src/basic/fileio.h	8
src/basic/fileio.c	69
src/fundamental/string-util-fundamental.c	4
src/basic/socket-util.c	36
src/boot/efi-string.c	6
src/basic/errno-util.h	5
src/basic/terminal-util.c	12
src/basic/stat-util.c	25
src/basic/stat-util.h	1
src/basic/fs-util.h	6
src/basic/fs-util.c	64
src/fundamental/string-util-fundamental.h	6
src/basic/fd-util.c	23
src/basic/label.c	3
src/basic/btrfs.c	18
src/basic/path-util.c	40
src/basic/path-util.h	4
src/basic/chattr-util.h	1
src/basic/chattr-util.c	15
src/basic/namespace-util.c	4
src/basic/memory-util.c	3
src/basic/string-util.c	21
src/boot/util.c	8
src/basic/nulstr-util.c	5
src/basic/alloc-util.c	7
src/basic/memory-util.h	7
src/basic/strv.h	1
src/basic/alloc-util.h	4
src/fundamental/memory-util-fundamental.h	1
src/basic/hexdecoct.c	11
src/basic/initrd-util.c	4
src/basic/env-util.c	4
src/boot/efi-string.h	3
src/test/test-proc-cmdline.c	3
src/basic/fd-util.h	3
src/basic/socket-util.h	3
src/basic/time-util.c	8
src/basic/time-util.h	4
src/timesync/timesyncd-manager.c	44
src/libsystemd/sd-event/sd-event.c	159
src/basic/prioq.c	14
src/basic/glyph-util.h	1
src/basic/glyph-util.c	4
src/basic/locale-util.c	9
src/tmpfiles/tmpfiles.c	65
src/basic/mountpoint-util.c	31
src/basic/hashmap.h	14
src/basic/hashmap.c	56
src/basic/set.h	8
src/basic/glob-util.c	5
src/basic/mempool.c	10
src/basic/signal-util.c	5
src/basic/hexdecoct.h	1
src/basic/psi-util.c	3
src/basic/cgroup-util.c	58
src/basic/string-util.h	4
src/libsystemd/sd-daemon/sd-daemon.c	43
src/basic/iovec-util.c	5
src/libsystemd/sd-id128/sd-id128.c	8
src/libsystemd/sd-id128/id128-util.h	1
src/libsystemd/sd-id128/id128-util.c	13
src/basic/io-util.c	7
src/basic/io-util.h	1
src/libsystemd/sd-resolve/sd-resolve.c	21
src/basic/inotify-util.c	4
src/shared/dns-domain.c	18
src/basic/hostname-util.c	2
src/libsystemd/sd-network/sd-network.c	15
src/basic/in-addr-util.c	5
src/shared/dns-domain.h	1
man/logcontrol-example.c	2
src/libsystemd/sd-journal/journal-send.c	34
src/basic/sparse-endian.h	4
src/basic/memfd-util.c	17
src/basic/utf8.c	17
src/timesync/timesyncd-server.c	16
src/timesync/timesyncd-server.h	1
src/journal/fuzz-journald.c	4
src/journal/journald-native.c	56
src/journal/journald-context.c	87
src/basic/user-util.c	37
src/basic/user-util.h	2
src/basic/process-util.h	2
src/basic/gunicode.c	2
src/basic/capability-util.c	8
src/basic/pidref.h	1
src/basic/capability-util.h	1
src/basic/pidref.c	13
src/basic/pidfd-util.c	24
src/basic/audit-util.c	13
src/journal/journald-client.c	18
src/basic/unit-name.c	9
src/basic/xattr-util.h	2
src/basic/xattr-util.c	37
src/basic/nulstr-util.h	1
src/shared/pcre2-util.c	17
src/basic/login-util.c	2
src/basic/capsule-util.c	3
src/basic/utf8.h	1
src/basic/unaligned.h	1
src/libsystemd/sd-journal/journal-file.c	144
src/basic/procfs-util.c	9
src/journal/journald-context.h	1
src/journal/journald-syslog.c	21
src/journal/journald-kmsg.c	9
src/journal/journald-console.c	15
src/journal/journald-wall.c	9
src/journal/journald-manager.c	143
src/journal/journald-rate-limit.c	21
src/fundamental/logarithm.h	1
src/libsystemd/sd-event/event-util.c	3
src/journal/journald-socket.c	24
src/shared/journal-file-util.c	48
src/libsystemd/sd-journal/journal-file.h	8
src/libsystemd/sd-journal/mmap-cache.c	41
src/basic/sigbus.c	6
src/boot/efi-log.c	6
src/shared/copy.c	65
src/shared/selinux-util.c	36
src/basic/mallinfo-util.h	1
src/basic/tmpfile-util.c	31
src/basic/random-util.h	1
src/basic/random-util.c	15
src/fundamental/sha256-fundamental.c	8
src/basic/sync-util.c	15
src/basic/gcrypt-util.h	1
src/basic/uid-classification.c	16
src/basic/chase.c	67
src/shared/acl-util.c	18
src/basic/dirent-util.c	9
src/libsystemd/sd-journal/journal-vacuum.c	32
src/basic/mkdir.h	1
src/basic/mkdir.c	20
src/libsystemd/sd-journal/sd-journal.c	122
src/basic/filesystems.c	6
src/basic/syslog-util.c	5
src/basic/prioq.h	1
src/shared/rm-rf.h	1
src/shared/rm-rf.c	46
src/shared/btrfs-util.c	41
src/shared/btrfs-util.h	2
src/libsystemd/sd-journal/journal-authenticate.c	29
src/libsystemd/sd-journal/fsprg.c	26
src/basic/gcrypt-util.c	7
src/basic/macro.h	1
src/basic/ratelimit.c	5
src/basic/siphash24.c	8
src/libsystemd/sd-journal/lookup3.h	1
src/libsystemd/sd-journal/lookup3.c	2
src/basic/compress.c	44
src/basic/compress.h	3