Report generation date: 2025-06-30

Project overview: tidy-html5

High level conclusions

Fuzzers reach 68.72% of cyclomatic complexity.

"No files with coverage data was found. This is either because an error occurred when compiling and running coverage runs, or because the introspector run was intentionally done without coverage collection. In order to get optimal results coverage data is needed.

Reachability and coverage overview

Functions statically reachable by fuzzers

605 / 999

Cyclomatic complexity statically reachable by fuzzers

5851 / 8514

Runtime code coverage of functions

0 / 999

Fuzzers overview

Fuzzer	Fuzzer filename	Functions Reached	Functions unreached	Fuzzer depth	Files reached	Basic blocks reached	Cyclomatic complexity	Details
tidy_config_fuzzer	tidy_config_fuzzer.c	164	874	12	20	1770	762	tidy_config_fuzzer.c
tidy_parse_file_fuzzer	tidy_parse_file_fuzzer.c	397	635	14	21	9475	3878	tidy_parse_file_fuzzer.c
tidy_fuzzer	tidy_fuzzer.c	584	446	18	20	14066	5706	tidy_fuzzer.c
tidy_general_fuzzer	tidy_general_fuzzer.c	405	628	14	21	9523	3900	tidy_general_fuzzer.c
tidy_parse_string_fuzzer	tidy_parse_string_fuzzer.c	583	446	18	20	14057	5701	tidy_parse_string_fuzzer.c
tidy_xml_fuzzer	tidy_xml_fuzzer.c	589	440	18	20	14122	5721	tidy_xml_fuzzer.c

Project functions overview

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer details

Fuzzer: tidy_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: tidy_parse_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: tidy_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: tidy_general_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: tidy_parse_string_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: tidy_xml_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	instr count	bb count	cyclomatic complexity	Reachable functions	total cyclomatic complexity	Unreached complexity
`prvTidyParseInline`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	2882	532	219	191	2278	275
`prvTidyParseBlock`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	13	2373	449	181	199	2284	233
`CheckSvgAttr`	/src/tidy-html5/src/attrs.c	3	['N/A', 'N/A', 'N/A']	8	725	157	60	39	365	212
`prvTidyParseBody`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	1352	240	97	201	2197	137
`prvTidyParseRow`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	807	136	52	178	2023	61
`prvTidyParseHTML`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	923	156	58	168	1978	58
`prvTidyParseList`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	742	128	51	178	2023	57
`prvTidyParsePre`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	651	108	41	175	2002	52
`prvTidyParseRowGroup`	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	752	133	51	172	1988	51
`ParseList`	/src/tidy-html5/src/config.c	2	['N/A', 'N/A']	10	378	59	22	64	406	46

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

653 / 999

Cyclomatic complexity statically reachable by fuzzers

7033 / 8514

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzz engine guidance

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.