High level conclusions

Fuzzers reach 53.45% code coverage.

Fuzzers reach 68.72% of cyclomatic complexity.

Fuzzers reach 60.56% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

605 / 999

Cyclomatic complexity statically reachable by fuzzers

5851 / 8514

Runtime code coverage of functions

534 / 999

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: tidy_xml_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1772	69.1%
gold	[1:9]	56	2.18%
yellow	[10:29]	73	2.84%
greenyellow	[30:49]	20	0.78%
lawngreen	50+	643	25.0%
All colors	2564	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
530	928	prvTidyDialogue	call site: 00928	ParseHTMLWithNode
374	1465	tidyDocCleanAndRepair	call site: 01465	prvTidyCleanDocument
187	1882	tidyBufFree	call site: 01882	prvTidyCheckHTML5
107	2426	prvTidyPPrintXMLTree	call site: 02426	prvTidyPrintBody
42	292	prvTidyAddCharToLexer	call site: 00292	prvTidyReadChar
40	1840	tidyBufCheckAlloc	call site: 01840	prvTidyReportAttrError
32	821	prvTidyCheckNodeIntegrity	call site: 00821	prvTidyParseDocument
19	271	prvTidyUngetChar	call site: 00271	ReadCharFromStream
17	2173	PPrintChar	call site: 02173	prvTidyHTMLVersion
15	712	ParseDocTypeDecl	call site: 00712	FindGivenVersion
15	2094	tidyDocSaveBuffer	call site: 02094	prvTidyDropFontElements
14	647	prvTidyRemoveAttribute	call site: 00647	prvTidyReportAttrError

Runtime coverage analysis

Covered functions

290

Functions that are reachable but not covered

319

Reachable functions

589

Percentage of reachable functions covered

45.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_xml_fuzzer.c	2
tidy-html5buffio.c	11
tidy-html5tidylib.c	29
tidy-html5lexer.c	86
tidy-html5tags.c	30
tidy-html5tmbstr.c	16
tidy-html5attrs.c	43
tidy-html5config.c	16
tidy-html5pprint.c	70
tidy-html5parser.c	40
tidy-html5language.c	9
tidy-html5streamio.c	36
tidy-html5message.c	18
tidy-html5utf8.c	11
tidy-html5messageobj.c	4
tidy-html5clean.c	71
tidy-html5istack.c	6
tidy-html5entities.c	3
tidy-html5access.c	71
tidy-html5gdoc.c	4

Fuzzer: tidy_parse_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	610	40.9%
gold	[1:9]	2	0.13%
yellow	[10:29]	5	0.33%
greenyellow	[30:49]	6	0.40%
lawngreen	50+	866	58.1%
All colors	1489	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
420	911	tidyMessageCreateInitV	call site: 00911	AccessibilityCheckNode
14	98	prvTidyWriteChar	call site: 00098	prvTidySplitSurrogatePair
13	84	messageOut	call site: 00084	prvTidyWriteChar
13	1435	TrimTrailingSpace	call site: 01435	EncloseBlockText
11	800	ParseHTMLWithNode	call site: 00800	prvTidyReport
10	1415	prvTidyIsBlank	call site: 01415	TrimSpaces
9	48	prvTidytmbstrtolower	call site: 00048	prvTidytmbstrdup
8	443	prvTidyelementIsAutonomousCustomFormat	call site: 00443	prvTidyDeclareUserTag
8	628	AttrsHaveSameName	call site: 00628	prvTidyReportAttrError
7	784	prvTidynodeCMIsEmpty	call site: 00784	ParseHTMLWithNode
6	841	prvTidyParseDocument	call site: 00841	prvTidyAccessibilityChecks
5	898	prvTidytmbsnprintf	call site: 00898	tidyLocalizedString

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

135

Reachable functions

397

Percentage of reachable functions covered

65.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_parse_file_fuzzer.c	2
tidy-html5buffio.c	4
tidy-html5tidylib.c	14
tidy-html5lexer.c	70
tidy-html5tags.c	28
tidy-html5tmbstr.c	15
tidy-html5attrs.c	32
tidy-html5config.c	14
tidy-html5pprint.c	3
tidy-html5parser.c	35
tidy-html5language.c	9
tidy-html5streamio.c	34
tidy-html5message.c	15
tidy-html5utf8.c	10
tidy-html5messageobj.c	4
tidy-html5mappedio.c	2
tidy-html5fileio.c	2
tidy-html5clean.c	1
tidy-html5istack.c	6
tidy-html5entities.c	2
tidy-html5access.c	71

Fuzzer: tidy_general_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	584	38.6%
gold	[1:9]	43	2.84%
yellow	[10:29]	20	1.32%
greenyellow	[30:49]	10	0.66%
lawngreen	50+	854	56.5%
All colors	1511	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
415	924	tidyMessageCreateInitV	call site: 00924	AccessibilityCheckNode
14	106	prvTidyWriteChar	call site: 00106	prvTidySplitSurrogatePair
13	92	messageOut	call site: 00092	prvTidyWriteChar
13	1443	TrimTrailingSpace	call site: 01443	EncloseBlockText
10	1423	prvTidyIsBlank	call site: 01423	TrimSpaces
9	48	prvTidytmbstrtolower	call site: 00048	prvTidytmbstrdup
8	451	prvTidyelementIsAutonomousCustomFormat	call site: 00451	prvTidyDeclareUserTag
8	810	prvTidyParseXMLDocument	call site: 00810	prvTidyFixXmlDecl
6	832	prvTidyParseDocument	call site: 00832	prvTidySetOptionBool
6	849	prvTidyParseDocument	call site: 00849	prvTidyAccessibilityChecks
5	906	prvTidytmbsnprintf	call site: 00906	tidyLocalizedString
4	281	prvTidyReadChar	call site: 00281	prvTidyDecodeMacRoman

Runtime coverage analysis

Covered functions

398

Functions that are reachable but not covered

130

Reachable functions

405

Percentage of reachable functions covered

67.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_general_fuzzer.c	3
tidy-html5buffio.c	8
tidy-html5tidylib.c	16
tidy-html5lexer.c	70
tidy-html5tags.c	28
tidy-html5tmbstr.c	15
tidy-html5attrs.c	32
tidy-html5config.c	14
tidy-html5pprint.c	3
tidy-html5parser.c	35
tidy-html5language.c	9
tidy-html5streamio.c	35
tidy-html5message.c	15
tidy-html5utf8.c	10
tidy-html5messageobj.c	4
tidy-html5mappedio.c	2
tidy-html5fileio.c	2
tidy-html5clean.c	1
tidy-html5istack.c	6
tidy-html5entities.c	2
tidy-html5access.c	71

Fuzzer: tidy_parse_string_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1105	43.4%
gold	[1:9]	20	0.78%
yellow	[10:29]	20	0.78%
greenyellow	[30:49]	10	0.39%
lawngreen	50+	1388	54.5%
All colors	2543	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
412	905	prvTidyDialogue	call site: 00905	AccessibilityCheckNode
198	1593	prvTidyPutUTF8	call site: 01593	prvTidyCleanDocument
83	1505	tidyDocCleanAndRepair	call site: 01505	prvTidyCleanWord2000
18	1957	prvTidyFixLanguageInformation	call site: 01957	prvTidyFixAnchors
15	2073	tidyDocSaveBuffer	call site: 02073	prvTidyDropFontElements
13	173	prvTidyWriteChar	call site: 00173	prvTidySplitSurrogatePair
13	1421	TrimTrailingSpace	call site: 01421	EncloseBlockText
13	1794	prvTidyRepairAttrValue	call site: 01794	prvTidyDiscardElement
13	2156	PPrintChar	call site: 02156	prvTidyHTMLVersion
13	2272	PPrintAttrValue	call site: 02272	WrapAttrVal
12	1880	prvTidySetXHTMLDocType	call site: 01880	prvTidyRepairAttrValue
11	786	ParseHTMLWithNode	call site: 00786	prvTidyReport

Runtime coverage analysis

Covered functions

507

Functions that are reachable but not covered

188

Reachable functions

583

Percentage of reachable functions covered

67.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_parse_string_fuzzer.c	2
tidy-html5buffio.c	11
tidy-html5tidylib.c	27
tidy-html5lexer.c	86
tidy-html5tags.c	30
tidy-html5tmbstr.c	16
tidy-html5attrs.c	43
tidy-html5config.c	14
tidy-html5pprint.c	70
tidy-html5parser.c	40
tidy-html5language.c	9
tidy-html5streamio.c	35
tidy-html5clean.c	71
tidy-html5istack.c	6
tidy-html5message.c	17
tidy-html5utf8.c	11
tidy-html5messageobj.c	4
tidy-html5entities.c	3
tidy-html5access.c	71
tidy-html5gdoc.c	4

Fuzzer: tidy_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1324	52.0%
gold	[1:9]	96	3.77%
yellow	[10:29]	94	3.69%
greenyellow	[30:49]	237	9.31%
lawngreen	50+	792	31.1%
All colors	2543	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
412	906	prvTidyDialogue	call site: 00906	AccessibilityCheckNode
198	1592	prvTidyPutUTF8	call site: 01592	prvTidyCleanDocument
83	1504	tidyDocCleanAndRepair	call site: 01504	prvTidyCleanWord2000
36	1821	prvTidyTidyMetaCharset	call site: 01821	prvTidyReportAttrError
36	1879	prvTidySetXHTMLDocType	call site: 01879	prvTidyDiscardElement
18	344	ParseEntity	call site: 00344	GetSurrogatePair
18	1956	prvTidyFixLanguageInformation	call site: 01956	prvTidyFixAnchors
17	2150	PPrintChar	call site: 02150	prvTidyHTMLVersion
15	1397	CleanSpaces	call site: 01397	EncloseBodyText
15	1474	prvTidyAddStyleProperty	call site: 01474	MergeProperties
15	2071	tidyDocSaveBuffer	call site: 02071	prvTidyDropFontElements
14	173	prvTidyWriteChar	call site: 00173	prvTidySplitSurrogatePair

Runtime coverage analysis

Covered functions

461

Functions that are reachable but not covered

210

Reachable functions

584

Percentage of reachable functions covered

64.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_fuzzer.c	2
tidy-html5buffio.c	11
tidy-html5tidylib.c	27
tidy-html5lexer.c	86
tidy-html5tags.c	30
tidy-html5tmbstr.c	16
tidy-html5attrs.c	43
tidy-html5config.c	14
tidy-html5pprint.c	70
tidy-html5parser.c	40
tidy-html5language.c	9
tidy-html5streamio.c	35
tidy-html5clean.c	71
tidy-html5istack.c	6
tidy-html5message.c	17
tidy-html5utf8.c	11
tidy-html5messageobj.c	4
tidy-html5entities.c	3
tidy-html5access.c	71
tidy-html5gdoc.c	4

Fuzzer: tidy_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	151	53.3%
gold	[1:9]	2	0.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	49	17.3%
lawngreen	50+	81	28.6%
All colors	283	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	54	tidyDocCreate	call site: 00054	tidyLoadConfig
27	171	prvTidyReadChar	call site: 00171	SkipWhite
20	200	prvTidySetOptionInt	call site: 00200	NextProperty
14	103	prvTidyWriteChar	call site: 00103	prvTidySplitSurrogatePair
9	42	prvTidytmbstrtolower	call site: 00042	prvTidytmbstrdup
9	93	PutByte	call site: 00093	EncodeLatin0
5	227	tidyBufInitWithAllocator	call site: 00227	tidyRelease
4	129	prvTidyinitFileSource	call site: 00129	FirstChar
4	164	prvTidyReadChar	call site: 00164	prvTidyDecodeMacRoman
3	89	messageOut	call site: 00089	prvTidyWriteChar
3	221	prvTidyfreeFileSource	call site: 00221	prvTidyfreeStdIOFileSource
3	262	prvTidyFreeAttrTable	call site: 00262	attrsRemoveFromHash

Runtime coverage analysis

Covered functions

536

Functions that are reachable but not covered

62

Reachable functions

164

Percentage of reachable functions covered

62.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tidy_config_fuzzer.c	1
tidy-html5tidylib.c	7
tidy-html5lexer.c	10
tidy-html5tags.c	8
tidy-html5tmbstr.c	7
tidy-html5attrs.c	13
tidy-html5config.c	27
tidy-html5pprint.c	3
tidy-html5parser.c	2
tidy-html5language.c	4
tidy-html5streamio.c	29
fuzzer_temp_file.h	2
tidy-html5message.c	8
tidy-html5utf8.c	9
tidy-html5messageobj.c	1
tidy-html5mappedio.c	2
tidy-html5fileio.c	2
tidy-html5buffio.c	2
tidy-html5clean.c	1
tidy-html5istack.c	4

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
prvTidyParseInline	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	2872	532	219	191	0	2278	275
prvTidyParseBlock	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	13	0	2364	449	181	199	0	2284	233
CheckSvgAttr	/src/tidy-html5/src/attrs.c	3	['N/A', 'N/A', 'N/A']	8	0	722	157	60	39	0	365	212
prvTidyParseBody	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	1342	240	97	201	0	2197	137
prvTidyParseRow	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	797	136	52	178	0	2023	61
prvTidyParseHTML	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	910	156	58	168	0	1978	58
prvTidyParseList	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	728	128	51	178	0	2023	57
prvTidyParsePre	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	642	108	41	175	0	2002	52
prvTidyParseRowGroup	/src/tidy-html5/src/parser.c	3	['N/A', 'N/A', 'int']	12	0	743	133	51	172	0	1988	51
ParseList	/src/tidy-html5/src/config.c	2	['N/A', 'N/A']	10	0	365	59	22	64	0	406	46

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

653 / 999

Cyclomatic complexity statically reachable by fuzzers

7033 / 8514

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tidy_xml_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['prvTidyDialogue', 'tidyDocCleanAndRepair', 'tidyBufFree', 'prvTidyPPrintXMLTree', 'prvTidyAddCharToLexer', 'tidyBufCheckAlloc', 'prvTidyCheckNodeIntegrity', 'prvTidyUngetChar', 'PPrintChar', 'ParseDocTypeDecl']

tidy_parse_file_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tidyMessageCreateInitV', 'prvTidyWriteChar', 'messageOut', 'TrimTrailingSpace', 'ParseHTMLWithNode', 'prvTidyIsBlank', 'prvTidytmbstrtolower', 'prvTidyelementIsAutonomousCustomFormat', 'AttrsHaveSameName', 'prvTidynodeCMIsEmpty']

tidy_general_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tidyMessageCreateInitV', 'prvTidyWriteChar', 'messageOut', 'TrimTrailingSpace', 'prvTidyIsBlank', 'prvTidytmbstrtolower', 'prvTidyelementIsAutonomousCustomFormat', 'prvTidyParseXMLDocument', 'prvTidyParseDocument']

tidy_parse_string_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['prvTidyDialogue', 'prvTidyPutUTF8', 'tidyDocCleanAndRepair', 'prvTidyFixLanguageInformation', 'tidyDocSaveBuffer', 'prvTidyWriteChar', 'TrimTrailingSpace', 'prvTidyRepairAttrValue', 'PPrintChar', 'PPrintAttrValue']

tidy_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['prvTidyDialogue', 'prvTidyPutUTF8', 'tidyDocCleanAndRepair', 'prvTidyTidyMetaCharset', 'prvTidySetXHTMLDocType', 'ParseEntity', 'prvTidyFixLanguageInformation', 'PPrintChar', 'CleanSpaces', 'prvTidyAddStyleProperty']

tidy_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tidyDocCreate', 'prvTidyReadChar', 'prvTidySetOptionInt', 'prvTidyWriteChar', 'prvTidytmbstrtolower', 'PutByte', 'tidyBufInitWithAllocator', 'prvTidyinitFileSource', 'messageOut']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
SortAttVal	50	9	18.0%	['tidy_parse_string_fuzzer', 'tidy_xml_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
prvTidyAdjustCharEncoding	48	25	52.08%	['tidy_xml_fuzzer', 'tidy_config_fuzzer']
prvTidytidySetLanguage	36	10	27.77%	['tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_xml_fuzzer']
PPrintChar	156	65	41.66%	['tidy_parse_string_fuzzer', 'tidy_xml_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
prvTidyWriteChar	122	20	16.39%	['tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_xml_fuzzer']
ReadCharFromStream	98	39	39.79%	['tidy_parse_file_fuzzer', 'tidy_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_xml_fuzzer']
ShouldIndent	32	4	12.5%	['tidy_parse_string_fuzzer', 'tidy_xml_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/tidy-html5/src/attrs.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/language_en_gb.h	[]	[]
/src/tidy_config_fuzzer.c	['tidy_config_fuzzer']	['tidy_config_fuzzer']
/src/tidy-html5/src/lexer.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/parser.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/buffio.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/tmbstr.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/messageobj.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/language_en.h	[]	[]
/src/tidy-html5/src/language_pt_br.h	[]	[]
/src/tidy-html5/src/language_es_mx.h	[]	[]
/src/tidy-html5/src/alloc.c	[]	[]
/src/tidy-html5/src/message.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/language_es.h	[]	[]
/src/tidy-html5/src/fileio.c	['tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	[]
/src/tidy-html5/src/utf8.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy_general_fuzzer.c	['tidy_general_fuzzer']	['tidy_general_fuzzer']
/src/tidy_parse_file_fuzzer.c	['tidy_parse_file_fuzzer']	['tidy_parse_file_fuzzer']
/src/tidy_fuzzer.c	['tidy_fuzzer']	['tidy_fuzzer']
/src/tidy-html5/src/clean.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/pprint.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/access.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer']	[]
/src/tidy_xml_fuzzer.c	['tidy_xml_fuzzer']	['tidy_xml_fuzzer']
/src/tidy-html5/src/language_zh_cn.h	[]	[]
/src/tidy-html5/src/language.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/language_de.h	[]	[]
/src/tidy-html5/src/streamio.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/config.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/fuzzer_temp_file.h	['tidy_config_fuzzer']	[]
/src/tidy-html5/src/istack.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/gdoc.c	['tidy_xml_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer']	[]
/src/tidy-html5/src/entities.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer']
/src/tidy-html5/src/tidylib.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy_parse_string_fuzzer.c	['tidy_parse_string_fuzzer']	['tidy_parse_string_fuzzer']
/src/tidy-html5/src/tags.c	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']	['tidy_xml_fuzzer', 'tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_parse_string_fuzzer', 'tidy_fuzzer', 'tidy_config_fuzzer']
/src/tidy-html5/src/language_fr.h	[]	[]
/src/tidy-html5/src/mappedio.c	['tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']	['tidy_parse_file_fuzzer', 'tidy_general_fuzzer', 'tidy_config_fuzzer']

Directories in report

Directory
/src/
/src/tidy-html5/src/