High level conclusions

Fuzzers reach 53.55% code coverage.

Fuzzers reach 68.72% of cyclomatic complexity.

Fuzzers reach 60.56% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

605 / 999

Cyclomatic complexity statically reachable by fuzzers

5851 / 8514

Runtime code coverage of functions

535 / 999

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: tidy_xml_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1772	69.1%
gold	[1:9]	106	4.13%
yellow	[10:29]	38	1.48%
greenyellow	[30:49]	30	1.17%
lawngreen	50+	618	24.1%
All colors	2564	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6105	6256	29 : View List ['prvTidyCleanStyle', 'prvTidyCleanWord2000', 'prvTidyBQ2Div', 'prvTidyCheckHTMLTagsAttribsVersions', 'prvTidySetXHTMLDocType', 'prvTidyDropSections', 'prvTidyTidyMetaCharset', 'prvTidyFixLanguageInformation', 'prvTidyRemoveNode', 'prvTidyIsWord2000', 'prvTidyCheckNodeIntegrity', 'prvTidyReport', 'prvTidyFixXhtmlNamespace', 'prvTidyFixAnchors', 'prvTidyFindXmlDecl', 'prvTidyEmFromI', 'prvTidytmbstrdup', 'prvTidyCleanDocument', 'prvTidyAddGenerator', 'prvTidyGetAttrByName', 'prvTidyCleanHead', 'prvTidyFixXmlDecl', 'prvTidyFindDocType', 'prvTidyCheckHTML5', 'prvTidyDropEmptyElements', 'prvTidyCleanGoogleDocument', 'prvTidyFixDocType', 'prvTidyList2BQ', 'prvTidyNestedEmphasis']	6105	6260	tidyDocCleanAndRepair	call site: 01464	/src/tidy-html5/src/tidylib.c:2121
3509	3509	1 : View List ['prvTidyParseDocument']	3509	3528	prvTidyDocParseStream	call site: 00222	/src/tidy-html5/src/tidylib.c:1500
369	369	1 : View List ['GetCDATA']	369	369	prvTidyGetToken	call site: 00247	/src/tidy-html5/src/lexer.c:2493
134	134	1 : View List ['WrapLine']	134	134	CheckWrapLine	call site: 02150	/src/tidy-html5/src/pprint.c:682
134	134	1 : View List ['WrapLine']	134	134	CheckWrapIndent	call site: 02129	/src/tidy-html5/src/pprint.c:698
125	125	1 : View List ['prvTidyReportBadArgument']	125	125	tidySetCharEncoding	call site: 00074	/src/tidy-html5/src/tidylib.c:277
123	123	1 : View List ['prvTidyReportEncodingWarning']	123	123	prvTidyReadBOMEncoding	call site: 00217	/src/tidy-html5/src/streamio.c:192
100	100	1 : View List ['WriteIndentChar']	100	294	PFlushLineImpl	call site: 02152	/src/tidy-html5/src/pprint.c:828
97	97	1 : View List ['prvTidyoutBOM']	2118	3108	tidyDocSaveStream	call site: 02113	/src/tidy-html5/src/tidylib.c:2316
92	92	1 : View List ['prvTidyDropFontElements']	2346	3432	tidyDocSaveStream	call site: 02097	/src/tidy-html5/src/tidylib.c:2295
81	81	1 : View List ['prvTidyDropComments']	2427	3513	tidyDocSaveStream	call site: 02095	/src/tidy-html5/src/tidylib.c:2292
79	79	1 : View List ['prvTidyDiscardElement']	79	79	ParseXMLElement	call site: 00000	/src/tidy-html5/src/parser.c:5736

Runtime coverage analysis

Covered functions

290

Functions that are reachable but not covered

319

Reachable functions

589

Percentage of reachable functions covered

45.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_xml_fuzzer.c	2
tidy-html5buffio.c	11
tidy-html5tidylib.c	29
tidy-html5lexer.c	86
tidy-html5tags.c	30
tidy-html5tmbstr.c	16
tidy-html5attrs.c	43
tidy-html5config.c	16
tidy-html5pprint.c	70
tidy-html5parser.c	40
tidy-html5language.c	9
tidy-html5streamio.c	36
tidy-html5message.c	18
tidy-html5utf8.c	11
tidy-html5messageobj.c	4
tidy-html5clean.c	71
tidy-html5istack.c	6
tidy-html5entities.c	3
tidy-html5access.c	71
tidy-html5gdoc.c	4

Fuzzer: tidy_parse_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	607	40.7%
gold	[1:9]	2	0.13%
yellow	[10:29]	5	0.33%
greenyellow	[30:49]	3	0.20%
lawngreen	50+	872	58.5%
All colors	1489	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1938	1938	1 : View List ['prvTidyParseXMLDocument']	1938	1957	prvTidyDocParseStream	call site: 00212	/src/tidy-html5/src/tidylib.c:1500
1364	1364	1 : View List ['prvTidyAccessibilityChecks']	1585	4464	prvTidyParseDocument	call site: 00841	/src/tidy-html5/src/parser.c:6346
178	317	4 : View List ['prvTidygetOption', 'prvTidyDeclareUserTag', 'prvTidyReport', 'tagsLookup']	178	317	prvTidyFindTag	call site: 00440	/src/tidy-html5/src/tags.c:581
123	123	1 : View List ['prvTidyReportFileError']	123	123	tidyDocParseFile	call site: 00119	/src/tidy-html5/src/tidylib.c:1170
43	50	2 : View List ['MergeProperties', 'prvTidytmbstrdup']	43	50	prvTidyAddStyleProperty	call site: 00000	/src/tidy-html5/src/clean.c:666
18	18	1 : View List ['EncodeLatin0']	18	18	prvTidyWriteChar	call site: 00085	/src/tidy-html5/src/streamio.c:521
15	15	1 : View List ['prvTidyfreeStdIOFileSource']	15	15	prvTidyfreeFileSource	call site: 01451	/src/tidy-html5/src/mappedio.c:86
12	12	1 : View List ['PutByte']	12	12	prvTidyWriteChar	call site: 00085	/src/tidy-html5/src/streamio.c:531
11	11	1 : View List ['EncodeWin1252']	11	11	prvTidyWriteChar	call site: 00085	/src/tidy-html5/src/streamio.c:513
10	12	3 : View List ['prvTidyIsCombinedChar', 'prvTidySplitSurrogatePair', 'prvTidyIsValidUTF16FromUCS4']	46	48	prvTidyWriteChar	call site: 00085	/src/tidy-html5/src/streamio.c:526
9	9	1 : View List ['EncodeMacRoman']	9	9	prvTidyWriteChar	call site: 00085	/src/tidy-html5/src/streamio.c:509
9	9	1 : View List ['EncodeIbm858']	9	9	prvTidyWriteChar	call site: 00085	/src/tidy-html5/src/streamio.c:517

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

135

Reachable functions

397

Percentage of reachable functions covered

65.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_parse_file_fuzzer.c	2
tidy-html5buffio.c	4
tidy-html5tidylib.c	14
tidy-html5lexer.c	70
tidy-html5tags.c	28
tidy-html5tmbstr.c	15
tidy-html5attrs.c	32
tidy-html5config.c	14
tidy-html5pprint.c	3
tidy-html5parser.c	35
tidy-html5language.c	9
tidy-html5streamio.c	34
tidy-html5message.c	15
tidy-html5utf8.c	10
tidy-html5messageobj.c	4
tidy-html5mappedio.c	2
tidy-html5fileio.c	2
tidy-html5clean.c	1
tidy-html5istack.c	6
tidy-html5entities.c	2
tidy-html5access.c	71

Fuzzer: tidy_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1337	52.5%
gold	[1:9]	84	3.30%
yellow	[10:29]	70	2.75%
greenyellow	[30:49]	27	1.06%
lawngreen	50+	1025	40.3%
All colors	2543	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1938	1938	1 : View List ['prvTidyParseXMLDocument']	1938	1957	prvTidyDocParseStream	call site: 00199	/src/tidy-html5/src/tidylib.c:1500
1364	1364	1 : View List ['prvTidyAccessibilityChecks']	1585	4464	prvTidyParseDocument	call site: 00828	/src/tidy-html5/src/parser.c:6346
1011	1011	1 : View List ['prvTidyPrintBody']	1011	1163	tidyDocSaveStream	call site: 02404	/src/tidy-html5/src/tidylib.c:2329
748	748	1 : View List ['prvTidyCleanDocument']	1645	4573	tidyDocCleanAndRepair	call site: 01602	/src/tidy-html5/src/tidylib.c:2153
730	1011	3 : View List ['prvTidyCleanWord2000', 'prvTidyDropEmptyElements', 'prvTidyDropSections']	2375	5584	tidyDocCleanAndRepair	call site: 01504	/src/tidy-html5/src/tidylib.c:2142
646	646	1 : View List ['prvTidyCleanGoogleDocument']	897	3825	tidyDocCleanAndRepair	call site: 01603	/src/tidy-html5/src/tidylib.c:2157
378	378	1 : View List ['PPrintCDATA']	378	378	prvTidyPPrintTree	call site: 02410	/src/tidy-html5/src/pprint.c:2311
178	317	4 : View List ['prvTidygetOption', 'prvTidyDeclareUserTag', 'prvTidyReport', 'tagsLookup']	178	317	prvTidyFindTag	call site: 00427	/src/tidy-html5/src/tags.c:581
100	100	1 : View List ['WriteIndentChar']	100	396	WrapLine	call site: 02108	/src/tidy-html5/src/pprint.c:659
100	100	1 : View List ['WriteIndentChar']	100	294	PFlushLineImpl	call site: 02129	/src/tidy-html5/src/pprint.c:828
97	97	1 : View List ['prvTidyoutBOM']	1946	3108	tidyDocSaveStream	call site: 02090	/src/tidy-html5/src/tidylib.c:2316
92	92	1 : View List ['prvTidyDropFontElements']	2106	3432	tidyDocSaveStream	call site: 02074	/src/tidy-html5/src/tidylib.c:2295

Runtime coverage analysis

Covered functions

462

Functions that are reachable but not covered

212

Reachable functions

584

Percentage of reachable functions covered

63.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_fuzzer.c	2
tidy-html5buffio.c	11
tidy-html5tidylib.c	27
tidy-html5lexer.c	86
tidy-html5tags.c	30
tidy-html5tmbstr.c	16
tidy-html5attrs.c	43
tidy-html5config.c	14
tidy-html5pprint.c	70
tidy-html5parser.c	40
tidy-html5language.c	9
tidy-html5streamio.c	35
tidy-html5clean.c	71
tidy-html5istack.c	6
tidy-html5message.c	17
tidy-html5utf8.c	11
tidy-html5messageobj.c	4
tidy-html5entities.c	3
tidy-html5access.c	71
tidy-html5gdoc.c	4

Fuzzer: tidy_parse_string_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1100	43.2%
gold	[1:9]	21	0.82%
yellow	[10:29]	23	0.90%
greenyellow	[30:49]	12	0.47%
lawngreen	50+	1387	54.5%
All colors	2543	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1938	1938	1 : View List ['prvTidyParseXMLDocument']	1938	1957	prvTidyDocParseStream	call site: 00198	/src/tidy-html5/src/tidylib.c:1500
1364	1364	1 : View List ['prvTidyAccessibilityChecks']	1585	4464	prvTidyParseDocument	call site: 00827	/src/tidy-html5/src/parser.c:6346
1011	1011	1 : View List ['prvTidyPrintBody']	1011	1163	tidyDocSaveStream	call site: 02406	/src/tidy-html5/src/tidylib.c:2329
748	748	1 : View List ['prvTidyCleanDocument']	1645	4573	tidyDocCleanAndRepair	call site: 01603	/src/tidy-html5/src/tidylib.c:2153
730	1011	3 : View List ['prvTidyCleanWord2000', 'prvTidyDropEmptyElements', 'prvTidyDropSections']	2375	5584	tidyDocCleanAndRepair	call site: 01505	/src/tidy-html5/src/tidylib.c:2142
646	646	1 : View List ['prvTidyCleanGoogleDocument']	897	3825	tidyDocCleanAndRepair	call site: 01604	/src/tidy-html5/src/tidylib.c:2157
178	317	4 : View List ['prvTidygetOption', 'prvTidyDeclareUserTag', 'prvTidyReport', 'tagsLookup']	178	317	prvTidyFindTag	call site: 00426	/src/tidy-html5/src/tags.c:581
97	97	1 : View List ['prvTidyoutBOM']	1946	3108	tidyDocSaveStream	call site: 02092	/src/tidy-html5/src/tidylib.c:2316
92	92	1 : View List ['prvTidyDropFontElements']	2106	3432	tidyDocSaveStream	call site: 02076	/src/tidy-html5/src/tidylib.c:2295
81	81	1 : View List ['prvTidyDropComments']	2187	3513	tidyDocSaveStream	call site: 02074	/src/tidy-html5/src/tidylib.c:2292
22	22	1 : View List ['prvTidyEmFromI']	2458	5667	tidyDocCleanAndRepair	call site: 01468	/src/tidy-html5/src/tidylib.c:2139
18	18	1 : View List ['EncodeLatin0']	18	18	prvTidyWriteChar	call site: 00159	/src/tidy-html5/src/streamio.c:521

Runtime coverage analysis

Covered functions

507

Functions that are reachable but not covered

188

Reachable functions

583

Percentage of reachable functions covered

67.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_parse_string_fuzzer.c	2
tidy-html5buffio.c	11
tidy-html5tidylib.c	27
tidy-html5lexer.c	86
tidy-html5tags.c	30
tidy-html5tmbstr.c	16
tidy-html5attrs.c	43
tidy-html5config.c	14
tidy-html5pprint.c	70
tidy-html5parser.c	40
tidy-html5language.c	9
tidy-html5streamio.c	35
tidy-html5clean.c	71
tidy-html5istack.c	6
tidy-html5message.c	17
tidy-html5utf8.c	11
tidy-html5messageobj.c	4
tidy-html5entities.c	3
tidy-html5access.c	71
tidy-html5gdoc.c	4

Fuzzer: tidy_general_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	573	37.9%
gold	[1:9]	33	2.18%
yellow	[10:29]	16	1.05%
greenyellow	[30:49]	20	1.32%
lawngreen	50+	869	57.5%
All colors	1511	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1364	1364	1 : View List ['prvTidyAccessibilityChecks']	1585	4464	prvTidyParseDocument	call site: 00849	/src/tidy-html5/src/parser.c:6346
178	317	4 : View List ['prvTidygetOption', 'prvTidyDeclareUserTag', 'prvTidyReport', 'tagsLookup']	178	317	prvTidyFindTag	call site: 00448	/src/tidy-html5/src/tags.c:581
123	123	1 : View List ['prvTidyReportFileError']	123	123	tidyDocParseFile	call site: 00127	/src/tidy-html5/src/tidylib.c:1170
43	50	2 : View List ['MergeProperties', 'prvTidytmbstrdup']	43	50	prvTidyAddStyleProperty	call site: 00000	/src/tidy-html5/src/clean.c:666
18	18	1 : View List ['EncodeLatin0']	18	18	prvTidyWriteChar	call site: 00093	/src/tidy-html5/src/streamio.c:521
15	15	1 : View List ['prvTidyfreeStdIOFileSource']	15	15	prvTidyfreeFileSource	call site: 01459	/src/tidy-html5/src/mappedio.c:86
12	12	1 : View List ['PutByte']	12	12	prvTidyWriteChar	call site: 00093	/src/tidy-html5/src/streamio.c:531
11	11	1 : View List ['EncodeWin1252']	11	11	prvTidyWriteChar	call site: 00093	/src/tidy-html5/src/streamio.c:513
10	12	3 : View List ['prvTidyIsCombinedChar', 'prvTidySplitSurrogatePair', 'prvTidyIsValidUTF16FromUCS4']	46	48	prvTidyWriteChar	call site: 00093	/src/tidy-html5/src/streamio.c:526
9	9	1 : View List ['EncodeMacRoman']	9	9	prvTidyWriteChar	call site: 00093	/src/tidy-html5/src/streamio.c:509
9	9	1 : View List ['EncodeIbm858']	9	9	prvTidyWriteChar	call site: 00093	/src/tidy-html5/src/streamio.c:517
8	8	1 : View List ['OptionChangedValuesDiffer']	11	23	CopyOptionValue	call site: 00027	/src/tidy-html5/src/config.c:391

Runtime coverage analysis

Covered functions

400

Functions that are reachable but not covered

129

Reachable functions

405

Percentage of reachable functions covered

68.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_general_fuzzer.c	3
tidy-html5buffio.c	8
tidy-html5tidylib.c	16
tidy-html5lexer.c	70
tidy-html5tags.c	28
tidy-html5tmbstr.c	15
tidy-html5attrs.c	32
tidy-html5config.c	14
tidy-html5pprint.c	3
tidy-html5parser.c	35
tidy-html5language.c	9
tidy-html5streamio.c	35
tidy-html5message.c	15
tidy-html5utf8.c	10
tidy-html5messageobj.c	4
tidy-html5mappedio.c	2
tidy-html5fileio.c	2
tidy-html5clean.c	1
tidy-html5istack.c	6
tidy-html5entities.c	2
tidy-html5access.c	71

Fuzzer: tidy_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	153	54.0%
gold	[1:9]	4	1.41%
yellow	[10:29]	1	0.35%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	125	44.1%
All colors	283	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1364	1364	1 : View List ['prvTidyAccessibilityChecks']	1585	4464	prvTidyParseDocument	call site: 00000	/src/tidy-html5/src/parser.c:6346
1011	1011	1 : View List ['prvTidyPrintBody']	1011	1163	tidyDocSaveStream	call site: 00000	/src/tidy-html5/src/tidylib.c:2329
748	748	1 : View List ['prvTidyCleanDocument']	1645	4573	tidyDocCleanAndRepair	call site: 00000	/src/tidy-html5/src/tidylib.c:2153
730	1011	3 : View List ['prvTidyCleanWord2000', 'prvTidyDropEmptyElements', 'prvTidyDropSections']	2375	5584	tidyDocCleanAndRepair	call site: 00000	/src/tidy-html5/src/tidylib.c:2142
646	646	1 : View List ['prvTidyCleanGoogleDocument']	897	3825	tidyDocCleanAndRepair	call site: 00000	/src/tidy-html5/src/tidylib.c:2157
178	317	4 : View List ['prvTidygetOption', 'prvTidyDeclareUserTag', 'prvTidyReport', 'tagsLookup']	178	317	prvTidyFindTag	call site: 00000	/src/tidy-html5/src/tags.c:581
125	125	1 : View List ['prvTidyReportBadArgument']	125	125	tidySetCharEncoding	call site: 00000	/src/tidy-html5/src/tidylib.c:277
123	123	1 : View List ['prvTidyReportFileError']	123	123	tidyDocParseFile	call site: 00000	/src/tidy-html5/src/tidylib.c:1170
97	97	1 : View List ['prvTidyoutBOM']	1108	3108	tidyDocSaveStream	call site: 00000	/src/tidy-html5/src/tidylib.c:2316
92	92	1 : View List ['prvTidyDropFontElements']	1268	3432	tidyDocSaveStream	call site: 00000	/src/tidy-html5/src/tidylib.c:2295
81	81	1 : View List ['prvTidyDropComments']	1349	3513	tidyDocSaveStream	call site: 00000	/src/tidy-html5/src/tidylib.c:2292
22	22	1 : View List ['prvTidyEmFromI']	2458	5667	tidyDocCleanAndRepair	call site: 00000	/src/tidy-html5/src/tidylib.c:2139

Runtime coverage analysis

Covered functions

537

Functions that are reachable but not covered

62

Reachable functions

164

Percentage of reachable functions covered

62.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_config_fuzzer.c	1
tidy-html5tidylib.c	7
tidy-html5lexer.c	10
tidy-html5tags.c	8
tidy-html5tmbstr.c	7
tidy-html5attrs.c	13
tidy-html5config.c	27
tidy-html5pprint.c	3
tidy-html5parser.c	2
tidy-html5language.c	4
tidy-html5streamio.c	29
fuzzer_temp_file.h	2
tidy-html5message.c	8
tidy-html5utf8.c	9
tidy-html5messageobj.c	1
tidy-html5mappedio.c	2
tidy-html5fileio.c	2
tidy-html5buffio.c	2
tidy-html5clean.c	1
tidy-html5istack.c	4

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
prvTidyParseInline	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	2882	532	219	191	0	2278	275
prvTidyParseBlock	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	13	0	2373	449	181	199	0	2284	233
CheckSvgAttr	/src/tidy-html5/src/attrs.c	3	['N/A', 'N/A', 'N/A']	8	0	725	157	60	39	0	365	212
prvTidyParseBody	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	1352	240	97	201	0	2197	137
prvTidyParseRow	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	807	136	52	178	0	2023	61
prvTidyParseHTML	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	923	156	58	168	0	1978	58
prvTidyParseList	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	742	128	51	178	0	2023	57
prvTidyParsePre	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	651	108	41	175	0	2002	52
prvTidyParseRowGroup	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	752	133	51	172	0	1988	51
ParseList	/src/tidy-html5/src/config.c	2	['N/A', 'N/A']	10	0	378	59	22	64	0	406	46

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

653 / 999

Cyclomatic complexity statically reachable by fuzzers

7033 / 8514

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tidy_xml_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['prvTidyDialogue', 'tidyDocCleanAndRepair', 'tidyBufFree', 'prvTidyPPrintXMLTree', 'prvTidyAddCharToLexer', 'tidyBufCheckAlloc', 'prvTidyCheckNodeIntegrity', 'PPrintChar', 'ParseDocTypeDecl', 'tidyDocSaveBuffer']

tidy_parse_file_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tidyMessageCreateInitV', 'prvTidyWriteChar', 'messageOut', 'TrimTrailingSpace', 'ParseHTMLWithNode', 'prvTidyIsBlank', 'prvTidytmbstrtolower', 'prvTidyelementIsAutonomousCustomFormat', 'AttrsHaveSameName', 'prvTidynodeCMIsEmpty']

tidy_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['prvTidyDialogue', 'prvTidyPutUTF8', 'tidyDocCleanAndRepair', 'prvTidyTidyMetaCharset', 'prvTidySetXHTMLDocType', 'ParseEntity', 'prvTidyFixLanguageInformation', 'PPrintChar', 'CleanSpaces', 'prvTidyAddStyleProperty']

tidy_parse_string_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['prvTidyDialogue', 'prvTidyPutUTF8', 'tidyDocCleanAndRepair', 'prvTidyFixLanguageInformation', 'tidyDocSaveBuffer', 'prvTidyWriteChar', 'TrimTrailingSpace', 'prvTidyRepairAttrValue', 'PPrintChar', 'prvTidySetXHTMLDocType']

tidy_general_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tidyMessageCreateInitV', 'prvTidyWriteChar', 'messageOut', 'TrimTrailingSpace', 'prvTidyIsBlank', 'prvTidytmbstrtolower', 'prvTidyelementIsAutonomousCustomFormat', 'prvTidyParseXMLDocument', 'prvTidyParseDocument', 'prvTidytmbsnprintf']

tidy_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['prvTidyReadChar', 'tidyDocCreate', 'prvTidySetOptionInt', 'prvTidyWriteChar', 'prvTidytmbstrtolower', 'PutByte', 'tidyBufInitWithAllocator', 'prvTidyinitFileSource', 'messageOut', 'prvTidyfreeFileSource']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
SortAttVal	50	9	18.0%	['tidy_config_fuzzer', 'tidy_xml_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer']
prvTidyAdjustCharEncoding	48	25	52.08%	['tidy_config_fuzzer', 'tidy_xml_fuzzer']
prvTidytidySetLanguage	36	10	27.77%	['tidy_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer', 'tidy_xml_fuzzer', 'tidy_parse_string_fuzzer']
PPrintChar	156	65	41.66%	['tidy_config_fuzzer', 'tidy_xml_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer']
prvTidyWriteChar	122	20	16.39%	['tidy_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer', 'tidy_xml_fuzzer', 'tidy_parse_string_fuzzer']
ReadCharFromStream	98	39	39.79%	['tidy_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer', 'tidy_xml_fuzzer', 'tidy_parse_string_fuzzer']
ShouldIndent	32	4	12.5%	['tidy_config_fuzzer', 'tidy_xml_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/tidy-html5/src/message.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/fileio.c	['tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	[]
/src/tidy_parse_file_fuzzer.c	['tidy_parse_file_fuzzer']	['tidy_parse_file_fuzzer']
/src/tidy-html5/src/tidylib.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/gdoc.c	['tidy_xml_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer']	[]
/src/tidy-html5/src/buffio.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/clean.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/pprint.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/tmbstr.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/fuzzer_temp_file.h	['tidy_config_fuzzer']	[]
/src/tidy-html5/src/streamio.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/config.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy_config_fuzzer.c	['tidy_config_fuzzer']	['tidy_config_fuzzer']
/src/tidy-html5/src/tags.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy_general_fuzzer.c	['tidy_general_fuzzer']	['tidy_general_fuzzer']
/src/tidy-html5/src/language_pt_br.h	[]	[]
/src/tidy-html5/src/messageobj.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/attrs.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/utf8.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/mappedio.c	['tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/language.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/language_es_mx.h	[]	[]
/src/tidy-html5/src/language_zh_cn.h	[]	[]
/src/tidy-html5/src/language_en_gb.h	[]	[]
/src/tidy-html5/src/language_de.h	[]	[]
/src/tidy-html5/src/alloc.c	[]	[]
/src/tidy_xml_fuzzer.c	['tidy_xml_fuzzer']	['tidy_xml_fuzzer']
/src/tidy-html5/src/language_en.h	[]	[]
/src/tidy-html5/src/lexer.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy_parse_string_fuzzer.c	['tidy_parse_string_fuzzer']	['tidy_parse_string_fuzzer']
/src/tidy-html5/src/language_fr.h	[]	[]
/src/tidy-html5/src/language_es.h	[]	[]
/src/tidy-html5/src/access.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer']	[]
/src/tidy-html5/src/parser.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/entities.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer']
/src/tidy-html5/src/istack.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']
/src/tidy_fuzzer.c	['tidy_fuzzer']	['tidy_fuzzer']

Directories in report

Directory
/src/
/src/tidy-html5/src/