High level conclusions

Fuzzers reach 0.247% of cyclomatic complexity.

Fuzzers reach 0.392% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

9 / 2295

Cyclomatic complexity statically reachable by fuzzers

14 / 5658

Runtime code coverage of functions

546 / 2295

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_query

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	2.63%
gold	[1:9]	13	34.2%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	63.1%
All colors	38	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	33	tracker_sparql_connection_update_statement	call site: 00033

Runtime coverage analysis

Covered functions

2694

Functions that are reachable but not covered

3

Reachable functions

19

Percentage of reachable functions covered

84.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_query.c	10
fuzzing/fuzz.h	1
src/libtinysparql/tracker-connection.c	7
src/libtinysparql/direct/tracker-direct.c	1

Fuzzer: fuzz_rdf_turtle

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.81%
gold	[1:9]	1	2.27%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	90.9%
All colors	44	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	4	LLVMFuzzerTestOneInput	call site: 00004

Runtime coverage analysis

Covered functions

2950

Functions that are reachable but not covered

8

Reachable functions

26

Percentage of reachable functions covered

69.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_rdf_turtle.c	10
fuzzing/fuzz.h	1
.gitlab-ci/coverity-model.c	3
src/libtinysparql/tracker-connection.c	6
src/libtinysparql/direct/tracker-direct.c	1
src/libtinysparql/tracker-batch.c	7

Fuzzer: fuzz_rdf_trig

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.81%
gold	[1:9]	1	2.27%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	90.9%
All colors	44	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	4	LLVMFuzzerTestOneInput	call site: 00004

Runtime coverage analysis

Covered functions

3092

Functions that are reachable but not covered

8

Reachable functions

26

Percentage of reachable functions covered

69.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_rdf_trig.c	10
fuzzing/fuzz.h	1
.gitlab-ci/coverity-model.c	3
src/libtinysparql/tracker-connection.c	6
src/libtinysparql/direct/tracker-direct.c	1
src/libtinysparql/tracker-batch.c	7

Fuzzer: fuzz_rdf_jsonld

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.81%
gold	[1:9]	1	2.27%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	90.9%
All colors	44	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	4	LLVMFuzzerTestOneInput	call site: 00004

Runtime coverage analysis

Covered functions

3306

Functions that are reachable but not covered

8

Reachable functions

26

Percentage of reachable functions covered

69.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_rdf_jsonld.c	10
fuzzing/fuzz.h	1
.gitlab-ci/coverity-model.c	3
src/libtinysparql/tracker-connection.c	6
src/libtinysparql/direct/tracker-direct.c	1
src/libtinysparql/tracker-batch.c	7

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
update_thread_func	/src/tinysparql/src/libtinysparql/direct/tracker-direct.c	2	['gpointer', 'gpointer']	23	0	60	19	18	614	0	1257	1255
tracker_data_manager_initable_init	/src/tinysparql/src/libtinysparql/core/tracker-data-manager.c	3	['GInitable*', 'GCancellable*', 'GError**']	16	0	182	35	70	523	0	985	327
translate_Collection	/src/tinysparql/src/libtinysparql/core/tracker-sparql.c	2	['TrackerSparql*', 'GError**']	10	0	84	9	17	217	0	354	297
tracker_deserializer_turtle_iterate_next	/src/tinysparql/src/libtinysparql/tracker-deserializer-turtle.c	2	['TrackerDeserializerTurtle*', 'GError**']	5	0	207	54	78	74	1	166	159
tracker_introspect	/src/tinysparql/src/cli/tracker-introspect.c	2	['int', 'char**']	7	0	16	3	4	132	0	138	120
translate_BuiltInCall	/src/tinysparql/src/libtinysparql/core/tracker-sparql.c	2	['TrackerSparql*', 'GError**']	7	0	453	78	76	127	0	241	109
tracker_deserializer_json_ld_next	/src/tinysparql/src/libtinysparql/tracker-deserializer-json-ld.c	3	['TrackerSparqlCursor*', 'GCancellable*', 'GError**']	5	0	24	7	8	67	0	89	79

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

636 / 2295

Cyclomatic complexity statically reachable by fuzzers

2360 / 5658

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzzing/fuzz_query.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tracker_sparql_connection_update_statement']

fuzzing/fuzz_rdf_turtle.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

fuzzing/fuzz_rdf_trig.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

fuzzing/fuzz_rdf_jsonld.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
tracker_data_manager_initable_init	207	104	50.24%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
tracker_data_manager_apply_db_change	296	35	11.82%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
tracker_data_update_buffer_flush	65	31	47.69%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
tracker_data_update_statement	44	20	45.45%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
cache_delete_resource_type_full	95	13	13.68%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
delete_single_valued	41	21	51.21%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
tracker_db_statement_bind_value	49	16	32.65%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
tracker_db_manager_new	103	34	33.00%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
db_set_params	34	12	35.29%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
tracker_ontologies_diff	268	57	21.26%	['fuzz_rdf_turtle', 'fuzz_query', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
g_buffered_input_stream_skip	49	15	30.61%
read_internal	138	54	39.13%
g_file_enumerator_next_file	33	16	48.48%
matcher_optimize	33	12	36.36%
g_io_modules_scan_all_in_directory_with_scope	95	12	12.63%
_g_io_module_get_default	95	51	53.68%
sandbox_info_read	51	18	35.29%
g_resource_find_overlay	105	22	20.95%
g_zlib_decompressor_convert	65	24	36.92%
g_checksum_update	32	12	37.5%
g_checksum_get_string	34	14	41.17%
g_convert_with_iconv	99	50	50.50%
convert_checked	39	12	30.76%
g_data_set_internal	69	37	53.62%
g_file_error_from_errno	103	7	6.796%
g_source_unref_internal	81	37	45.67%
mapped_file_new_from_fd	63	22	34.92%
g_logv	96	51	53.12%
msort_r	71	26	36.61%
msort_with_tmp	117	9	7.692%
g_string_insert_len	51	23	45.09%
g_private_get_impl	32	15	46.87%
g_time_zone_adjust_time	43	23	53.48%
zone_identifier_unix	76	41	53.94%
parse_time	51	26	50.98%
uri_decoder	70	23	32.85%
fast_validate	61	9	14.75%
gvs_tuple_get_child	57	29	50.87%
g_variant_format_string_scan	87	24	27.58%
valid_format_string	33	9	27.27%
g_variant_valist_get_leaf	81	22	27.16%
g_variant_valist_get_nnp	61	12	19.67%
g_variant_type_is_subtype_of	40	18	45.0%
_g_locale_get_charset_aliases	92	32	34.78%
object_interface_check_properties	77	15	19.48%
find_pspec	33	17	51.51%
g_param_spec_pool_lookup	43	20	46.51%
param_spec_ht_lookup	40	18	45.0%
signal_parse_name	36	11	30.55%
handler_insert	37	13	35.13%
g_type_interface_add_prerequisite	64	31	48.43%
check_type_info_I	71	22	30.98%
check_value_table_I	54	19	35.18%
check_derivation_I	36	12	33.33%
type_data_ref_Wm	32	8	25.0%
check_add_interface_L	64	27	42.18%
_g_type_test_flags	41	17	41.46%
sqlite3_config	160	27	16.87%
mallocWithAlarm	32	16	50.0%
sqlite3DbFreeNN	33	13	39.39%
sqlite3DbMallocRawNN	40	11	27.50%
robust_open	33	13	39.39%
sqlite3BitvecSet	56	11	19.64%
sqlite3PagerSetFlags	31	17	54.83%
getPageNormal	77	41	53.24%
sqlite3WalClose	39	5	12.82%
sqlite3PagerSharedLock	106	17	16.03%
sqlite3PagerCommitPhaseOne	72	24	33.33%
sqlite3DbNNFreeNN	31	11	35.48%
vdbeCommit	162	53	32.71%
sqlite3VtabSavepoint	36	7	19.44%
sqlite3VdbeExec	4341	2342	53.95%
btreeCreateTable	94	27	28.72%
valueFromExpr	128	34	26.56%
yy_reduce	1569	733	46.71%
sqlite3ExprAffinity	49	25	51.02%
sqlite3VtabOverloadFunction	36	14	38.88%
sqlite3FindInIndex	154	76	49.35%
sqlite3ExprIfFalse	139	58	41.72%
sqlite3EndTable	247	100	40.48%
sqlite3ProcessJoin	107	11	10.28%
sqlite3ExprIsInteger	47	17	36.17%
sqlite3AddPrimaryKey	66	36	54.54%
sqlite3TriggerList	32	11	34.37%
sqlite3Select	805	293	36.39%
sqlite3WindowRewrite	119	10	8.403%
countOfViewOptimization	63	9	14.28%
sqlite3WhereTabFuncArgs	42	7	16.66%
exprAnalyze	338	166	49.11%
isAuxiliaryVtabOperator	83	25	30.12%
sqlite3WhereAddLimit	40	7	17.5%
sqlite3WhereExplainOneScan	85	6	7.058%
sqlite3WhereCodeOneLoopStart	912	271	29.71%
sqlite3ExprNeedsNoAffinityChange	32	12	37.5%
selectInnerLoop	259	92	35.52%
sqlite3WhereEnd	247	127	51.41%
sqlite3SrcListAppendFromTerm	50	26	52.0%
triggersReallyExist	50	27	54.0%
sqlite3GenerateRowDelete	72	37	51.38%
codeTriggerProgram	59	29	49.15%
sqlite3GenerateConstraintChecks	590	294	49.83%
sqlite3UpsertDoUpdate	51	21	41.17%
autoIncBegin	37	8	21.62%
sqlite3UpsertAnalyzeTarget	100	36	36.0%
sqlite3Pragma	1502	187	12.45%
setupLookaside	89	47	52.80%
sqlite3AutoLoadExtensions	33	9	27.27%
createCollation	44	20	45.45%
tracker_db_manager_release_memory	35	14	40.0%	['fuzz_rdf_turtle', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
collect_tables	35	18	51.42%	['fuzz_rdf_turtle', 'fuzz_rdf_jsonld', 'fuzz_rdf_trig']
g_thread_pool_wait_for_new_pool	62	24	38.70%
closure_invoke_notifiers	53	17	32.07%
weak_ref_data_list_remove	34	12	35.29%
handler_unref_R	45	16	35.55%
pager_truncate	31	10	32.25%
sqlite3BtreeDelete	136	55	40.44%
sqlite3AffinityType	57	28	49.12%
sqlite3ExprIfTrue	131	23	17.55%
sqlite3ColumnsFromExprList	91	40	43.95%
viewGetColumnNames	80	19	23.75%
agginfoPersistExprCb	32	6	18.75%
substExpr	93	46	49.46%
whereLoopAddVirtual	95	39	41.05%
findOrCreateAggInfoColumn	54	28	51.85%
updateAccumulator	139	61	43.88%
finalizeAggFunctions	52	15	28.84%
resetAccumulator	59	17	28.81%
sqlite3ExprDataType	59	14	23.72%
resolveCompoundOrderBy	85	8	9.411%
multiSelect	271	79	29.15%
yy_destructor	101	40	39.60%
jsonbPayloadSize	57	29	50.87%
jsonReturnString	36	18	50.0%
g_date_time_format_utf8	338	91	26.92%
format_z	44	20	45.45%
handlers_find	66	13	19.69%

New fuzzers

The below fuzzers are templates and suggestions for how to target the set of optimal functions above

tracker-direct.c

Target file: /src/tinysparql/src/libtinysparql/direct/tracker-direct.c
Target functions: update_thread_func

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target update_thread_func */
  UNKNOWN_TYPE unknown_0;
  UNKNOWN_TYPE unknown_1;
  update_thread_func(unknown_0, unknown_1);

  af_safe_gb_cleanup();
}

tracker-data-manager.c

Target file: /src/tinysparql/src/libtinysparql/core/tracker-data-manager.c
Target functions: tracker_data_manager_initable_init

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target tracker_data_manager_initable_init */
  UNKNOWN_TYPE unknown_2;
  UNKNOWN_TYPE unknown_3;
  UNKNOWN_TYPE unknown_4;
  tracker_data_manager_initable_init(unknown_2, unknown_3, unknown_4);

  af_safe_gb_cleanup();
}

tracker-sparql.c

Target file: /src/tinysparql/src/libtinysparql/core/tracker-sparql.c
Target functions: translate_Collection, translate_BuiltInCall

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target translate_Collection */
  UNKNOWN_TYPE unknown_5;
  UNKNOWN_TYPE unknown_6;
  translate_Collection(unknown_5, unknown_6);

  /* target translate_BuiltInCall */
  UNKNOWN_TYPE unknown_11;
  UNKNOWN_TYPE unknown_12;
  translate_BuiltInCall(unknown_11, unknown_12);

  af_safe_gb_cleanup();
}

tracker-deserializer-turtle.c

Target file: /src/tinysparql/src/libtinysparql/tracker-deserializer-turtle.c
Target functions: tracker_deserializer_turtle_iterate_next

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target tracker_deserializer_turtle_iterate_next */
  UNKNOWN_TYPE unknown_7;
  UNKNOWN_TYPE unknown_8;
  tracker_deserializer_turtle_iterate_next(unknown_7, unknown_8);

  af_safe_gb_cleanup();
}

tracker-introspect.c

Target file: /src/tinysparql/src/cli/tracker-introspect.c
Target functions: tracker_introspect

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target tracker_introspect */
  int new_var9 = ada_safe_get_int();
  char **new_var10 = af_get_double_char_p();
  tracker_introspect(new_var9, new_var10);

  af_safe_gb_cleanup();
}

tracker-deserializer-json-ld.c

Target file: /src/tinysparql/src/libtinysparql/tracker-deserializer-json-ld.c
Target functions: tracker_deserializer_json_ld_next

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target tracker_deserializer_json_ld_next */
  UNKNOWN_TYPE unknown_13;
  UNKNOWN_TYPE unknown_14;
  UNKNOWN_TYPE unknown_15;
  tracker_deserializer_json_ld_next(unknown_13, unknown_14, unknown_15);

  af_safe_gb_cleanup();
}

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
/src/tinysparql/src/cli/tracker-introspect.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-endpoint.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-fts-tokenizer.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-deserializer.c	[]	[]
/src/tinysparql/examples/libtinysparql/async-connection.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-collation.c	[]	[]
/src/tinysparql/docs/tools/tracker-utils.c	[]	[]
/src/tinysparql/src/portal/tracker-portal-utils.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-class.h	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-connection-test.c	[]	[]
/src/tinysparql/src/cli/tracker-query.c	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-deserialize-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-resource.c	[]	[]
/src/tinysparql/src/cli/tracker-help.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-db-interface.c	[]	[]
/src/tinysparql/src/common/tracker-utils.c	[]	[]
/src/tinysparql/utils/mtp/mtp-dummy.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-endpoint-dbus.h	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-sparql-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-connection.c	['fuzz_query', 'fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']	['fuzz_query', 'fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']
/src/tinysparql/src/common/tracker-language.h	[]	[]
/src/tinysparql/src/common/tracker-date-time.c	[]	[]
/src/tinysparql/fuzzing/fuzz_rdf_turtle.c	['fuzz_rdf_turtle']	['fuzz_rdf_turtle']
/src/tinysparql/docs/tools/tracker-docgen-md.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-ontologies-rdf.c	[]	[]
/src/tinysparql/src/web-ide/tracker-webide.c	[]	[]
/src/tinysparql/fuzzing/fuzz.h	['fuzz_query', 'fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']	['fuzz_query', 'fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']
/src/tinysparql/src/libtinysparql/tracker-serializer-turtle.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-endpoint-http.h	[]	[]
/src/tinysparql/src/libtinysparql/tracker-error.c	[]	[]
/src/tinysparql/src/libtinysparql/remote/tracker-remote.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-batch.c	['fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']	['fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']
/src/tinysparql/src/portal/tracker-portal-endpoint.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-sparql.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-deserializer-rdf.c	[]	[]
/src/tinysparql/tests/core/tracker-insert-or-replace-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-serializer-json.c	[]	[]
/src/tinysparql/tests/common/tracker-utils-test.c	[]	[]
/src/tinysparql/tests/core/tracker-sparql-blank-test.c	[]	[]
/src/tinysparql/fuzzing/driver.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-ontologies-introspect.c	[]	[]
/src/tinysparql/src/libtinysparql/bus/tracker-bus-cursor.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-notifier.c	[]	[]
/src/tinysparql/src/libtinysparql/direct/tracker-direct.c	['fuzz_query', 'fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']	['fuzz_query', 'fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']
/src/tinysparql/src/libtinysparql/core/tracker-vtab-service.c	[]	[]
/src/tinysparql/fuzzing/fuzz_rdf_trig.c	['fuzz_rdf_trig']	['fuzz_rdf_trig']
/src/tinysparql/src/common/tracker-parser-utils.h	[]	[]
/src/tinysparql/src/common/tracker-file-utils.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-property.h	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-vtab-triples.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-endpoint-dbus.c	[]	[]
/src/tinysparql/tests/functional-tests/test_ipc/test-bus-query-cancellation.c	[]	[]
/src/tinysparql/src/libtinysparql/bus/tracker-bus-batch.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-data-update.h	[]	[]
/src/tinysparql/src/libtinysparql/tracker-serializer.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-rowid.c	[]	[]
/src/tinysparql/src/common/tracker-term-utils.c	[]	[]
/src/tinysparql/src/libtinysparql/direct/tracker-direct.h	[]	[]
/src/tinysparql/src/libtinysparql/tracker-deserializer-json-ld.c	[]	[]
/src/tinysparql/src/libtinysparql/direct/tracker-direct-batch.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-ontology.h	[]	[]
/src/tinysparql/tests/core/tracker-refcount-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-endpoint-http.c	[]	[]
/src/tinysparql/src/libtinysparql/bus/tracker-bus.c	[]	[]
/src/tinysparql/src/cli/tracker-webide.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-ontologies.h	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-data-manager.h	[]	[]
/src/tinysparql/src/portal/tracker-portal-endpoint.h	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-resource-test.c	[]	[]
/src/tinysparql/docs/reference/examples/notifier-example.c	[]	[]
/src/tinysparql/src/libtinysparql/bus/tracker-bus-statement.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-namespace.h	[]	[]
/src/tinysparql/tests/common/tracker-parser-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-deserializer-turtle.c	[]	[]
/src/tinysparql/src/cli/tracker-sql.c	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-serialize-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-uri.c	[]	[]
/src/tinysparql/utils/benchmark/tracker-benchmark.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-utils.c	[]	[]
/src/tinysparql/tests/core/tracker-service-test.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-string-builder.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-deserializer-json.c	[]	[]
/src/tinysparql/src/portal/tracker-main.c	[]	[]
/src/tinysparql/docs/tools/tracker-ontology-model.c	[]	[]
/src/tinysparql/tests/core/tracker-ontology-test.c	[]	[]
/src/tinysparql/tests/common/tracker-file-utils-test.c	[]	[]
/src/tinysparql/src/libtinysparql/direct/tracker-direct-statement.h	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-db-manager.c	[]	[]
/src/tinysparql/src/common/tracker-parser-utils.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-data-update.c	[]	[]
/src/tinysparql/docs/tools/tracker-utils.h	[]	[]
/src/tinysparql/src/libtinysparql/tracker-version.h	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-cursor-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-serializer-xml.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-cursor.c	[]	[]
/src/tinysparql/fuzzing/fuzz_query.c	['fuzz_query']	['fuzz_query']
/src/tinysparql/src/libtinysparql/core/tracker-uuid.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-namespace-manager.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-statement.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-serializer-trig.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-sparql-types.h	[]	[]
/src/tinysparql/fuzzing/fuzz_rdf_jsonld.c	['fuzz_rdf_jsonld']	['fuzz_rdf_jsonld']
/src/tinysparql/src/libtinysparql/core/tracker-sparql-grammar.h	[]	[]
/src/tinysparql/src/cli/tracker-endpoint.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-ontologies-diff.c	[]	[]
/src/tinysparql/src/portal/tracker-portal.c	[]	[]
/src/tinysparql/src/http/tracker-http.c	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-fd-test.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-db-interface-sqlite.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-ontology.c	[]	[]
/src/tinysparql/src/common/tracker-language.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-data-query.c	[]	[]
/src/tinysparql/src/cli/tracker-main.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-data-manager.c	[]	[]
/src/tinysparql/src/cli/tracker-import.c	[]	[]
/src/tinysparql/tests/core/tracker-ontology-error-test.c	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-namespaces-test.c	[]	[]
/src/tinysparql/src/common/tracker-parser-libicu.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-property.c	[]	[]
/src/tinysparql/tests/core/tracker-ontology-change-test.c	[]	[]
/src/tinysparql/tests/common/tracker-parser.c	[]	[]
/src/tinysparql/src/cli/tracker-export.c	[]	[]
/src/tinysparql/src/libtinysparql/direct/tracker-direct-statement.c	[]	[]
/src/tinysparql/.gitlab-ci/coverity-model.c	['fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']	['fuzz_rdf_turtle', 'fuzz_rdf_trig', 'fuzz_rdf_jsonld']
/src/tinysparql/src/libtinysparql/core/tracker-ontologies.c	[]	[]
/src/tinysparql/src/libtinysparql/remote/tracker-remote-namespaces.c	[]	[]
/src/tinysparql/src/http/tracker-http-module.c	[]	[]
/src/tinysparql/tests/fts/tracker-fts-test.c	[]	[]
/src/tinysparql/src/http/tracker-http-module.h	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-namespace.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-serializer-json-ld.c	[]	[]
/src/tinysparql/src/libtinysparql/remote/tracker-remote-statement.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-sparql-types.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-sparql-parser.c	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-statement-test.c	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-db-interface.h	[]	[]
/src/tinysparql/src/libtinysparql/core/tracker-class.c	[]	[]
/src/tinysparql/src/common/tracker-parser.c	[]	[]
/src/tinysparql/src/common/tracker-parser-libunistring.c	[]	[]
/src/tinysparql/tests/core/tracker-initialization-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-version.c	[]	[]
/src/tinysparql/tests/libtinysparql/tracker-batch-test.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-deserializer-resource.c	[]	[]
/src/tinysparql/src/libtinysparql/tracker-deserializer-xml.c	[]	[]

Directories in report

Directory
/src/tinysparql/.gitlab-ci/
/src/tinysparql/src/libtinysparql/
/src/tinysparql/utils/mtp/
/src/tinysparql/tests/functional-tests/test_ipc/
/src/tinysparql/src/http/
/src/tinysparql/tests/common/
/src/tinysparql/docs/tools/
/src/tinysparql/src/libtinysparql/remote/
/src/tinysparql/src/cli/
/src/tinysparql/src/web-ide/
/src/tinysparql/fuzzing/
/src/tinysparql/tests/core/
/src/tinysparql/src/libtinysparql/core/
/src/tinysparql/src/libtinysparql/bus/
/src/tinysparql/tests/fts/
/src/tinysparql/utils/benchmark/
/src/tinysparql/src/common/
/src/tinysparql/docs/reference/examples/
/src/tinysparql/src/portal/
/src/tinysparql/src/libtinysparql/direct/
/src/tinysparql/tests/libtinysparql/
/src/tinysparql/examples/libtinysparql/

This section shows a list of 3rd party function calls and their relative coverage information. By static analysis of the target project code, all of the 3rd party function call and their caller information, including the source file and line number that initiate the call are captured. The caller source code file and line number are shown in column 2 while column 1 is the function name of the 3rd party function call. Each occurrent of the 3rd party function call will occuply a separate row. Column 3 of each row indicate if the 3rd party call in the source file line is unreachable. Column 4 lists all fuzzers that have covered that particular system call in that specific location (source file and line)during their dynamic fuzzing.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Covered by Fuzzers