High level conclusions

Fuzzer input-fuzzer is blocked:

The runtime code coverage of input-fuzzer covers 22.44% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer layout-fuzzer is blocked:

The runtime code coverage of layout-fuzzer covers 24.06% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer format-fuzzer is blocked:

The runtime code coverage of format-fuzzer covers 24.39% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer json-fuzzer is blocked:

The runtime code coverage of json-fuzzer covers 17.56% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 17.54% of cyclomatic complexity.

Fuzzers reach 16.27% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1019 / 6261

Cyclomatic complexity statically reachable by fuzzers

4667 / 26600

Runtime code coverage of functions

860 / 6261

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: json-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	318	70.8%
gold	[1:9]	4	0.89%
yellow	[10:29]	7	1.55%
greenyellow	[30:49]	2	0.44%
lawngreen	50+	118	26.2%
All colors	449	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
240	167	json_string_append	call site: 00167	evbuffer_add_vprintf
24	8	xvasprintf	call site: 00008	xmalloc
14	33	xmalloc	call site: 00033	fatal
14	409	json_string_append	call site: 00409	evbuffer_chain_insert_new
4	88	xstrndup	call site: 00088	fatal
4	123	json_destroy_node	call site: 00123	RB_REMOVE
3	162	json_to_string	call site: 00162	fatalx
2	60	xreallocarray	call site: 00060	fatal
2	72	json_create_node	call site: 00072	fatalx
2	158	walk_json	call site: 00158	walk_json
2	432	json_string_append	call site: 00432	mode_tree_find_item
2	443	json_to_string	call site: 00443	evbuffer_decref_and_unlock_

Runtime coverage analysis

Covered functions

112

Functions that are reachable but not covered

169

Reachable functions

205

Percentage of reachable functions covered

17.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tmux/fuzz/json-fuzzer.c	15
tmux/json.c	52
tmux/xmalloc.c	14
tmux/compat/asprintf.c	5
tmux/log.c	12
tmux/compat/vis.c	8
tmux/compat/reallocarray.c	1
tmux/compat/strndup.c	3
tmux/environ.c	2
libevent/buffer.c	56
libevent/log.c	15
libevent/evutil.c	7
libevent/event.c	45
libevent/minheap-internal.h	3
libevent/evmap.c	6
libevent/listener.c	1
tmux/mode-tree.c	1

Fuzzer: style-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	27.3%
gold	[1:9]	3	1.20%
yellow	[10:29]	1	0.40%
greenyellow	[30:49]	4	1.60%
lawngreen	50+	173	69.4%
All colors	249	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	22	xmalloc	call site: 00022	fatal
10	11	log_debug	call site: 00011	log_vwrite
10	40	vis	call site: 00040	isoctal
9	203	utf8_width	call site: 00203	log_debug
9	235	hyperlinks_put	call site: 00235	hyperlinks_remove
2	181	hyperlinks_init	call site: 00181	fatalx
2	192	xreallocarray	call site: 00192	fatal
2	199	utf8_open	call site: 00199	fatalx
2	229	xvasprintf	call site: 00229	fatal
1	184	xcalloc	call site: 00184	fatal
1	186	hyperlinks_init	call site: 00186	RB_INIT
1	190	utf8_stravis	call site: 00190	fatalx

Runtime coverage analysis

Covered functions

103

Functions that are reachable but not covered

52

Reachable functions

79

Percentage of reachable functions covered

34.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tmux/fuzz/style-fuzzer.c	7
tmux/style.c	16
tmux/log.c	12
tmux/compat/asprintf.c	5
tmux/xmalloc.c	10
tmux/compat/vis.c	8
tmux/compat/strtonum.c	1
tmux/colour.c	11
tmux/attributes.c	7
tmux/hyperlinks.c	13
tmux/utf8.c	17
tmux/compat/reallocarray.c	1
tmux/compat/utf8proc.c	2

Fuzzer: cmd-parse-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	35.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	65.0%
All colors	40	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	4	cmd_list_free	call site: 00004	TAILQ_REMOVE
4	24	args_free	call site: 00024	RB_REMOVE

Runtime coverage analysis

Covered functions

477

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tmux/fuzz/cmd-parse-fuzzer.c	5
tmux/cmd.c	5
tmux/mode-tree.c	4
tmux/arguments.c	8
tmux/environ.c	2

Fuzzer: format-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1415	57.2%
gold	[1:9]	6	0.24%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1052	42.5%
All colors	2473	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
207	511	args_escape	call site: 00511	format_expand1
166	135	log_debug	call site: 00135	job_run
157	1166	format_free	call site: 01166	server_client_unref
118	356	xasprintf	call site: 00356	cmd_stringify_argv
101	1033	format_defaults	call site: 01033	event_payload_add_formats
70	2308	format_replace	call site: 02308	screen_free
69	1745	utf8_set	call site: 01745	grid_string_cells_code
34	1710	format_replace	call site: 01710	signal_cb_swp
26	1516	format_loop_panes	call site: 01516	format_choose
25	329	options_get_only	call site: 00329	options_get_string
24	1350	format_loop_windows	call site: 01350	format_choose
22	828	format_replace	call site: 00828	tty_feature_present

Runtime coverage analysis

Covered functions

431

Functions that are reachable but not covered

434

Reachable functions

574

Percentage of reachable functions covered

24.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tmux/fuzz/format-fuzzer.c	8
tmux/format.c	164
tmux/xmalloc.c	16
tmux/log.c	12
tmux/compat/asprintf.c	5
tmux/compat/vis.c	8
tmux/cmd-queue.c	3
tmux/tmux.c	12
tmux/compat/clock_gettime.c	2
tmux/compat/reallocarray.c	1
tmux/compat/strndup.c	3
tmux/job.c	41
libevent/bufferevent.c	29
libevent/bufferevent_pair.c	4
libevent/buffer.c	58
libevent/event.c	92
libevent/log.c	15
libevent/evutil.c	12
libevent/minheap-internal.h	7
libevent/evmap.c	17
libevent/listener.c	4
tmux/environ.c	22
tmux/options.c	28
tmux/compat/fdforkpty.c	1
tmux/compat/forkpty-haiku.c	12
tmux/cmd.c	16
tmux/proc.c	4
tmux/compat/setenv.c	2
tmux/compat/closefrom.c	1
tmux/arguments.c	18
tmux/utf8.c	24
tmux/compat/utf8proc.c	2
tmux/compat/strlcat.c	1
libevent/bufferevent_sock.c	11
libevent/bufferevent_async.c	13
libevent/event_iocp.c	2
libevent/buffer_iocp.c	2
libevent/bufferevent_ratelim.c	1
tmux/server-client.c	3
tmux/compat/strtonum.c	1
tmux/tty-term.c	4
tmux/tty-features.c	6
tmux/colour.c	19
tmux/sort.c	5
tmux/events-payload.c	14
tmux/paste.c	3
tmux/window.c	17
libevent/evutil_time.c	12
tmux/mode-tree.c	5
tmux/key-string.c	9
tmux/names.c	6
libevent/test/regress.c	3
tmux/grid-view.c	3
tmux/grid.c	32
tmux/hyperlinks.c	15
tmux/format-draw.c	10
tmux/fuzzy.c	35
tmux/style.c	16
tmux/attributes.c	7
tmux/file.c	6
tmux/regsub.c	10
tmux/window-clock.c	3
tmux/screen.c	8
tmux/screen-write.c	6
tmux/image-grid.c	8
tmux/image.c	5
tmux/json.c	2

Fuzzer: layout-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3880	81.6%
gold	[1:9]	68	1.43%
yellow	[10:29]	23	0.48%
greenyellow	[30:49]	10	0.21%
lawngreen	50+	770	16.2%
All colors	4751	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
318	3939	window_pane_free	call site: 03939	http_on_ws_early_free_cb
296	2079	style_parse	call site: 02079	format_expand1
249	3536	window_pane_resize	call site: 03536	window_clock_resize
196	933	xrealloc	call site: 00933	format_expand1
186	3320	recallocarray	call site: 03320	screen_write_stop
164	457	format_defaults	call site: 00457	event_payload_add_formats
162	1649	options_array_next	call site: 01649	format_loop_add_option
160	1812	utf8_set	call site: 01812	format_choose
144	763	options_get_string	call site: 00763	cmd_stringify_argv
143	194	log_debug	call site: 00194	event_add
111	79	alerts_reset	call site: 00079	event_del_
88	1557	options_array_item	call site: 01557	format_expand1

Runtime coverage analysis

Covered functions

309

Functions that are reachable but not covered

773

Reachable functions

1018

Percentage of reachable functions covered

24.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tmux/fuzz/layout-fuzzer.c	10
tmux/window.c	136
tmux/xmalloc.c	17
tmux/log.c	12
tmux/compat/asprintf.c	5
tmux/compat/vis.c	8
tmux/options.c	48
tmux/alerts.c	12
libevent/event.c	95
libevent/log.c	15
libevent/evutil.c	16
libevent/minheap-internal.h	7
libevent/evmap.c	17
libevent/listener.c	4
libevent/evutil_time.c	19
tmux/compat/clock_gettime.c	2
tmux/style.c	31
tmux/format.c	166
tmux/cmd-queue.c	3
tmux/events-payload.c	35
libevent/buffer.c	67
tmux/paste.c	3
tmux/tmux.c	15
tmux/compat/reallocarray.c	1
tmux/compat/strndup.c	3
tmux/job.c	41
libevent/bufferevent.c	30
libevent/bufferevent_pair.c	4
tmux/environ.c	22
tmux/compat/fdforkpty.c	1
tmux/compat/forkpty-haiku.c	12
tmux/cmd.c	20
tmux/proc.c	4
tmux/compat/setenv.c	2
tmux/compat/closefrom.c	1
tmux/arguments.c	25
tmux/utf8.c	30
tmux/compat/utf8proc.c	2
tmux/compat/strlcat.c	1
libevent/bufferevent_sock.c	11
libevent/bufferevent_async.c	13
libevent/event_iocp.c	2
libevent/buffer_iocp.c	2
libevent/bufferevent_ratelim.c	1
tmux/server-client.c	4
tmux/compat/strtonum.c	1
tmux/tty-term.c	4
tmux/tty-features.c	6
tmux/colour.c	24
tmux/sort.c	5
tmux/mode-tree.c	5
tmux/key-string.c	9
tmux/names.c	6
libevent/test/regress.c	3
tmux/grid-view.c	18
tmux/grid.c	63
tmux/hyperlinks.c	15
tmux/format-draw.c	10
tmux/fuzzy.c	35
tmux/attributes.c	7
tmux/file.c	6
tmux/regsub.c	10
tmux/window-clock.c	23
tmux/screen.c	48
tmux/screen-write.c	115
tmux/image-grid.c	42
tmux/image.c	13
tmux/json.c	41
tmux/layout-custom.c	86
tmux/layout.c	47
tmux/menu.c	6
tmux/server-fn.c	6
tmux/tty.c	16
tmux/session.c	4
tmux/status.c	3
tmux/window-visible.c	13
tmux/compat/recallocarray.c	7
tmux/compat/explicit_bzero.c	1
tmux/screen-redraw.c	9
tmux/utf8-combined.c	5
tmux/cmd-find.c	16
tmux/events.c	19
tmux/hooks.c	3
tmux/monitor.c	7
libevent/test/regress_ws.c	1
libevent/ws.c	24
libevent/http.c	61
libevent/sha1.c	11
tmux/server.c	1
tmux/spawn.c	14
tmux/prompt.c	2
tmux/input.c	8
tmux/image-kitty.c	5
tmux/resize.c	32
tmux/control.c	2

Fuzzer: input-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4501	82.7%
gold	[1:9]	30	0.55%
yellow	[10:29]	1	0.01%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	905	16.6%
All colors	5437	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
630	4008	cmdq_next	call site: 04008	cmd_kill_session_exec
318	3402	window_pane_free	call site: 03402	http_on_ws_early_free_cb
301	4988	server_status_window	call site: 04988	server_check_unattached
296	2075	style_parse	call site: 02075	format_expand1
196	929	xrealloc	call site: 00929	format_expand1
160	1808	utf8_set	call site: 01808	format_choose
156	461	format_defaults_pane	call site: 00461	event_payload_add_formats
152	1645	options_array_next	call site: 01645	format_loop_add_option
144	759	options_get_string	call site: 00759	cmd_stringify_argv
143	192	log_debug	call site: 00192	event_add
111	77	alerts_reset	call site: 00077	event_del_
91	2438	screen_free_titles	call site: 02438	format_replace

Runtime coverage analysis

Covered functions

459

Functions that are reachable but not covered

826

Reachable functions

1065

Percentage of reachable functions covered

22.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tmux/fuzz/input-fuzzer.c	15
tmux/window.c	152
tmux/xmalloc.c	17
tmux/log.c	12
tmux/compat/asprintf.c	5
tmux/compat/vis.c	8
tmux/options.c	48
tmux/alerts.c	24
libevent/event.c	114
libevent/log.c	15
libevent/evutil.c	16
libevent/minheap-internal.h	7
libevent/evmap.c	17
libevent/listener.c	5
libevent/evutil_time.c	19
tmux/compat/clock_gettime.c	2
tmux/style.c	31
tmux/format.c	166
tmux/cmd-queue.c	70
tmux/events-payload.c	35
libevent/buffer.c	67
tmux/paste.c	3
tmux/tmux.c	16
tmux/compat/reallocarray.c	1
tmux/compat/strndup.c	3
tmux/job.c	41
libevent/bufferevent.c	31
libevent/bufferevent_pair.c	14
tmux/environ.c	22
tmux/compat/fdforkpty.c	1
tmux/compat/forkpty-haiku.c	12
tmux/cmd.c	26
tmux/proc.c	11
tmux/compat/setenv.c	2
tmux/compat/closefrom.c	1
tmux/arguments.c	34
tmux/utf8.c	30
tmux/compat/utf8proc.c	2
tmux/compat/strlcat.c	1
libevent/bufferevent_sock.c	11
libevent/bufferevent_async.c	13
libevent/event_iocp.c	2
libevent/buffer_iocp.c	2
libevent/bufferevent_ratelim.c	1
tmux/server-client.c	26
tmux/compat/strtonum.c	1
tmux/tty-term.c	5
tmux/tty-features.c	6
tmux/colour.c	24
tmux/sort.c	5
tmux/mode-tree.c	5
tmux/key-string.c	9
tmux/names.c	6
libevent/test/regress.c	3
tmux/grid-view.c	18
tmux/grid.c	63
tmux/hyperlinks.c	15
tmux/format-draw.c	10
tmux/fuzzy.c	35
tmux/attributes.c	7
tmux/file.c	28
tmux/regsub.c	10
tmux/window-clock.c	23
tmux/screen.c	48
tmux/screen-write.c	119
tmux/image-grid.c	42
tmux/image.c	13
tmux/json.c	2
tmux/input.c	44
tmux/menu.c	6
tmux/tty.c	24
tmux/session.c	43
tmux/status.c	21
tmux/window-visible.c	13
tmux/compat/recallocarray.c	7
tmux/compat/explicit_bzero.c	1
tmux/screen-redraw.c	9
tmux/compat/err.c	7
tmux/events.c	24
tmux/cmd-find.c	70
tmux/hooks.c	3
tmux/monitor.c	7
libevent/test/regress_ws.c	1
libevent/ws.c	24
libevent/http.c	61
libevent/sha1.c	11
tmux/layout.c	39
tmux/server.c	16
tmux/spawn.c	14
tmux/prompt.c	2
tmux/image-kitty.c	5
tmux/compat/systemd.c	2
tmux/server-fn.c	30
tmux/control.c	28
tmux/cfg.c	4
tmux/compat/imsg.c	11
tmux/compat/imsg-buffer.c	15
tmux/compat/freezero.c	2
tmux/cmd-kill-session.c	21
tmux/resize.c	32
tmux/utf8-combined.c	5
libevent/signal.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
window_customize_menu	/src/tmux/window-customize.c	3	['void*', 'struct client*', 'key_code']	55	0	5	2	2	1380	0	5667	2157
http_cancel_test	/src/libevent/test/regress_http.c	1	['void*']	23	0	84	18	18	731	0	1934	1367
server_client_check_redraw	/src/tmux/server-client.c	1	['struct client*']	32	0	74	20	24	1030	2	4612	979

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1814 / 6261

Cyclomatic complexity statically reachable by fuzzers

9170 / 26600

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tmux/fuzz/json-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['json_string_append', 'xvasprintf', 'xmalloc', 'xstrndup', 'json_destroy_node', 'json_to_string', 'xreallocarray', 'json_create_node', 'walk_json']

tmux/fuzz/style-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmalloc', 'log_debug', 'vis', 'utf8_width', 'hyperlinks_put', 'hyperlinks_init', 'xreallocarray', 'utf8_open', 'xvasprintf', 'xcalloc']

tmux/fuzz/cmd-parse-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cmd_list_free', 'args_free']

tmux/fuzz/format-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['args_escape', 'log_debug', 'format_free', 'xasprintf', 'format_defaults', 'format_replace', 'utf8_set', 'format_loop_panes', 'options_get_only']

tmux/fuzz/layout-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['window_pane_free', 'style_parse', 'window_pane_resize', 'xrealloc', 'recallocarray', 'format_defaults', 'options_array_next', 'utf8_set', 'options_get_string', 'log_debug']

tmux/fuzz/input-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cmdq_next', 'window_pane_free', 'server_status_window', 'style_parse', 'xrealloc', 'utf8_set', 'format_defaults_pane', 'options_array_next', 'options_get_string', 'log_debug']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
options_array_RB_INSERT_COLOR	42	22	52.38%
options_array_set	79	21	26.58%	['style-fuzzer', 'layout-fuzzer', 'format-fuzzer', 'cmd-parse-fuzzer', 'json-fuzzer', 'input-fuzzer']
hyperlinks_by_inner_tree_RB_INSERT_COLOR	42	22	52.38%
cmd_find_from_client	33	4	12.12%	['cmd-parse-fuzzer', 'input-fuzzer']
colour_tostring	60	17	28.33%	['cmd-parse-fuzzer', 'layout-fuzzer', 'input-fuzzer', 'format-fuzzer']
format_cb_mouse_status_range	33	7	21.21%	['cmd-parse-fuzzer', 'format-fuzzer']
format_cb_session_group_attached_list	32	9	28.12%	['cmd-parse-fuzzer', 'format-fuzzer']
format_loop_windows	66	18	27.27%	['cmd-parse-fuzzer', 'layout-fuzzer', 'input-fuzzer', 'format-fuzzer']
format_loop_panes	51	16	31.37%	['cmd-parse-fuzzer', 'layout-fuzzer', 'input-fuzzer', 'format-fuzzer']
format_relative_time	33	18	54.54%	['cmd-parse-fuzzer', 'layout-fuzzer', 'input-fuzzer', 'format-fuzzer']
key_string_lookup_key	138	54	39.13%	['cmd-parse-fuzzer', 'layout-fuzzer', 'input-fuzzer', 'format-fuzzer']
regsub	46	23	50.0%	['cmd-parse-fuzzer', 'format-fuzzer']
windows_RB_INSERT_COLOR	42	7	16.66%
window_pane_tree_RB_INSERT_COLOR	42	22	52.38%
recalculate_size	48	23	47.91%	['layout-fuzzer']
clients_calculate_size	103	34	33.00%	['layout-fuzzer']
spawn_editor_finish	46	8	17.39%	['layout-fuzzer', 'input-fuzzer']
cmdq_next	56	11	19.64%	['input-fuzzer']
colour_totheme	31	4	12.90%	['input-fuzzer']
paste_time_tree_RB_INSERT_COLOR	42	21	50.0%
input_add_request	41	11	26.82%	['input-fuzzer']
screen_write_clearendofscreen	62	26	41.93%	['input-fuzzer']
screen_write_clearstartofscreen	54	23	42.59%	['input-fuzzer']
screen_write_clearscreen	45	20	44.44%	['input-fuzzer']
screen_write_pane_is_obscured	35	18	51.42%	['layout-fuzzer', 'input-fuzzer']
screen_write_combine	94	38	40.42%	['input-fuzzer']
screen_check_selection	74	5	6.756%	['input-fuzzer']
utf8_should_combine	98	11	11.22%	['input-fuzzer']
hanguljamo_get_subclass	53	5	9.433%	['input-fuzzer']
window_visible_ranges	117	29	24.78%	['layout-fuzzer', 'input-fuzzer']

New fuzzers

The below fuzzers are templates and suggestions for how to target the set of optimal functions above

window-customize.c

Target file: /src/tmux/window-customize.c
Target functions: window_customize_menu

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target window_customize_menu */
  UNKNOWN_TYPE unknown_0;
  structclient* new_var1 = calloc(sizeof(structclient), 1);
  UNKNOWN_TYPE unknown_2;
  window_customize_menu(unknown_0, new_var1, unknown_2);

  af_safe_gb_cleanup();
}

regress_http.c

Target file: /src/libevent/test/regress_http.c
Target functions: http_cancel_test

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target http_cancel_test */
  UNKNOWN_TYPE unknown_3;
  http_cancel_test(unknown_3);

  af_safe_gb_cleanup();
}

server-client.c

Target file: /src/tmux/server-client.c
Target functions: server_client_check_redraw

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target server_client_check_redraw */
  structclient* new_var4 = calloc(sizeof(structclient), 1);
  server_client_check_redraw(new_var4);

  af_safe_gb_cleanup();
}

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
/src/tmux/window-border.c	[]	[]
/src/tmux/screen.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/grid-view.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/libevent/bufferevent.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/image-decode.c	[]	[]
/src/tmux/input.c	['layout-fuzzer', 'input-fuzzer']	['input-fuzzer']
/src/tmux/cfg.c	['input-fuzzer']	[]
/src/libevent/test/test-fdleak.c	[]	[]
/src/tmux/compat/strnlen.c	[]	[]
/src/tmux/compat/strtonum.c	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-respawn-pane.c	[]	[]
/src/tmux/job.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/test/tinytest.h	[]	[]
/src/tmux/window-customize.c	[]	[]
/src/libevent/buffer.c	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/cmd-set-option.c	[]	[]
/src/libevent/test/regress_http.c	[]	[]
/src/libevent/include/event2/event_struct.h	[]	[]
/src/tmux/grid.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-swap-pane.c	[]	[]
/src/tmux/fuzz/input-fuzzer.c	['input-fuzzer']	['input-fuzzer']
/src/tmux/hooks.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/cmd-show-environment.c	[]	[]
/src/libevent/bufferevent_sock.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/cmd-run-shell.c	[]	[]
/src/tmux/paste.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/libevent/sample/event-read-fifo.c	[]	[]
/src/tmux/compat/strlcat.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/libevent/test-export/test-export.c	[]	[]
/src/tmux/cmd-kill-window.c	[]	[]
/src/libevent/test/test-closed.c	[]	[]
/src/libevent/win32select.c	[]	[]
/src/tmux/image-kitty.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/cmd-source-file.c	[]	[]
/src/tmux/mode-tree.c	['json-fuzzer', 'cmd-parse-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/environ.c	['json-fuzzer', 'cmd-parse-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['json-fuzzer', 'cmd-parse-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/compat/bitstring.h	[]	[]
/src/libevent/include/event2/event_compat.h	[]	[]
/src/libevent/evthread_pthread.c	[]	[]
/src/tmux/tmux.h	[]	[]
/src/tmux/cmd-list-sessions.c	[]	[]
/src/tmux/prompt.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/test/print-winsock-errors.c	[]	[]
/src/tmux/arguments.c	['cmd-parse-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['cmd-parse-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/colour.c	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/compat/closefrom.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/json.c	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['json-fuzzer', 'layout-fuzzer']
/src/tmux/control.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/log-internal.h	[]	[]
/src/tmux/compat/tree.h	[]	[]
/src/tmux/cmd-new-window.c	[]	[]
/src/tmux/fuzz/format-fuzzer.c	['format-fuzzer']	['format-fuzzer']
/src/libevent/ratelim-internal.h	[]	[]
/src/tmux/compat/strcasestr.c	[]	[]
/src/tmux/cmd-switch-client.c	[]	[]
/src/tmux/window.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/libevent/bufferevent_ssl.c	[]	[]
/src/tmux/cmd-list-clients.c	[]	[]
/src/libevent/ws.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/test/regress_openssl.c	[]	[]
/src/libevent/include/event2/tag_compat.h	[]	[]
/src/tmux/server.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/compat/getpeereid.c	[]	[]
/src/libevent/ht-internal.h	[]	[]
/src/tmux/resize.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer']
/src/libevent/evport.c	[]	[]
/src/tmux/compat/imsg.c	['input-fuzzer']	[]
/src/libevent/test/regress_iocp.c	[]	[]
/src/tmux/compat/forkpty-aix.c	[]	[]
/src/libevent/devpoll.c	[]	[]
/src/libevent/minheap-internal.h	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/signal.c	['input-fuzzer']	[]
/src/libevent/include/event2/rpc_compat.h	[]	[]
/src/tmux/session.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/test/test-time.c	[]	[]
/src/tmux/layout-custom.c	['layout-fuzzer']	['layout-fuzzer']
/src/tmux/cmd-new-session.c	[]	[]
/src/libevent/test/regress_listener.c	[]	[]
/src/tmux/cmd-capture-pane.c	[]	[]
/src/libevent/WIN32-Code/getopt_long.c	[]	[]
/src/tmux/cmd-unbind-key.c	[]	[]
/src/libevent/sample/ws-chat-server.c	[]	[]
/src/libevent/kqueue.c	[]	[]
/src/libevent/test/test-changelist.c	[]	[]
/src/tmux/format.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/xmalloc.c	['json-fuzzer', 'style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['json-fuzzer', 'style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/compat/err.c	['input-fuzzer']	[]
/src/tmux/compat/strlcpy.c	[]	[]
/src/tmux/server-fn.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/libevent/evutil_rand.c	[]	[]
/src/tmux/cmd-attach-session.c	[]	[]
/src/libevent/test/regress_minheap.c	[]	[]
/src/libevent/sample/http-connect.c	[]	[]
/src/tmux/window-visible.c	['layout-fuzzer', 'input-fuzzer']	['input-fuzzer']
/src/tmux/window-switch.c	[]	[]
/src/tmux/tty-acs.c	[]	[]
/src/tmux/cmd-find-window.c	[]	[]
/src/libevent/sample/time-test.c	[]	[]
/src/libevent/test/regress_rpc.c	[]	[]
/src/tmux/compat/asprintf.c	['json-fuzzer', 'style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/regsub.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer']
/src/tmux/events-payload.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/compat/reallocarray.c	['json-fuzzer', 'style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/include/event2/util.h	[]	[]
/src/libevent/test/regress_main.c	[]	[]
/src/tmux/key-string.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer']
/src/tmux/client.c	[]	[]
/src/libevent/test/tinytest_macros.h	[]	[]
/src/libevent/watch.c	[]	[]
/src/libevent/include/event2/rpc.h	[]	[]
/src/tmux/compat/queue.h	[]	[]
/src/tmux/cmd-server-access.c	[]	[]
/src/libevent/test/regress_thread.c	[]	[]
/src/tmux/cmd-list-panes.c	[]	[]
/src/tmux/compat/setproctitle.c	[]	[]
/src/tmux/cmd-wait-for.c	[]	[]
/src/libevent/test/regress_finalize.c	[]	[]
/src/libevent/sample/le-proxy.c	[]	[]
/src/tmux/cmd-kill-server.c	[]	[]
/src/tmux/screen-redraw.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-confirm-before.c	[]	[]
/src/tmux/cmd-list-commands.c	[]	[]
/src/libevent/mm-internal.h	[]	[]
/src/tmux/cmd-show-options.c	[]	[]
/src/libevent/sample/ssl-client-mbedtls.c	[]	[]
/src/tmux/window-client.c	[]	[]
/src/libevent/evmap.c	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/tty-features.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/sample/becat.c	[]	[]
/src/libevent/include/event2/bufferevent_compat.h	[]	[]
/src/tmux/compat/fdforkpty.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/test/regress_et.c	[]	[]
/src/libevent/event_iocp.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/event.c	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/test/regress_zlib.c	[]	[]
/src/libevent/bufferevent-internal.h	[]	[]
/src/libevent/sample/hostcheck.c	[]	[]
/src/tmux/compat/getprogname.c	[]	[]
/src/tmux/alerts.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-rename-session.c	[]	[]
/src/tmux/cmd-list-keys.c	[]	[]
/src/tmux/tty-keys.c	[]	[]
/src/tmux/utf8.c	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-rename-window.c	[]	[]
/src/tmux/options-table.c	[]	[]
/src/tmux/cmd-bind-key.c	[]	[]
/src/tmux/cmd-send-keys.c	[]	[]
/src/tmux/image.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/test/regress_testutils.c	[]	[]
/src/tmux/spawn.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/libevent/test/regress_ssl.c	[]	[]
/src/tmux/style.c	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/libevent/test/test-kq-collision.c	[]	[]
/src/libevent/buffer_iocp.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/control-notify.c	[]	[]
/src/tmux/status.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/tty-draw.c	[]	[]
/src/libevent/test/regress_bufferevent.c	[]	[]
/src/libevent/signalfd.c	[]	[]
/src/tmux/events.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/screen-write.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-display-message.c	[]	[]
/src/libevent/test/bench_cascade.c	[]	[]
/src/tmux/attributes.c	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['style-fuzzer', 'format-fuzzer']
/src/tmux/server-client.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['input-fuzzer']
/src/libevent/sha1.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/evbuffer-internal.h	[]	[]
/src/tmux/cmd-choose-tree.c	[]	[]
/src/libevent/wepoll.c	[]	[]
/src/tmux/key-bindings.c	[]	[]
/src/tmux/log.c	['json-fuzzer', 'style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['json-fuzzer', 'style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/window-panes.c	[]	[]
/src/tmux/osdep-openbsd.c	[]	[]
/src/tmux/cmd-display-menu.c	[]	[]
/src/tmux/compat.h	[]	[]
/src/libevent/include/event2/buffer_compat.h	[]	[]
/src/libevent/util-internal.h	[]	[]
/src/tmux/cmd-show-prompt-history.c	[]	[]
/src/tmux/utf8-combined.c	['layout-fuzzer', 'input-fuzzer']	['input-fuzzer']
/src/libevent/sample/openssl_hostname_validation.c	[]	[]
/src/tmux/cmd-save-buffer.c	[]	[]
/src/libevent/test/regress.h	[]	[]
/src/tmux/cmd-copy-mode.c	[]	[]
/src/libevent/test/regress_dns.c	[]	[]
/src/tmux/fuzz/layout-fuzzer.c	['layout-fuzzer']	['layout-fuzzer']
/src/libevent/select.c	[]	[]
/src/tmux/cmd-find.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/libevent/test/regress_buffer.c	[]	[]
/src/tmux/compat/unvis.c	[]	[]
/src/tmux/cmd-pipe-pane.c	[]	[]
/src/libevent/event-internal.h	[]	[]
/src/tmux/image-grid.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/cmd-join-pane.c	[]	[]
/src/tmux/compat/daemon.c	[]	[]
/src/tmux/compat/keyring-linux.c	[]	[]
/src/libevent/test/regress_watch.c	[]	[]
/src/libevent/test/tinytest.c	[]	[]
/src/tmux/cmd-if-shell.c	[]	[]
/src/libevent/test/regress.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/image-fallback.c	[]	[]
/src/tmux/cmd-kill-session.c	['input-fuzzer']	[]
/src/libevent/test/bench_httpclient.c	[]	[]
/src/libevent/test/regress_timer_timeout.c	[]	[]
/src/libevent/bufferevent_pair.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/evrpc.c	[]	[]
/src/tmux/image-sixel.c	[]	[]
/src/libevent/sample/dns-example.c	[]	[]
/src/libevent/test/regress_util.c	[]	[]
/src/libevent/epolltable-internal.h	[]	[]
/src/tmux/monitor.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/cmd-set-environment.c	[]	[]
/src/libevent/test/test-dumpevents.c	[]	[]
/src/libevent/sample/http-server.c	[]	[]
/src/tmux/fuzz/json-fuzzer.c	['json-fuzzer']	['json-fuzzer']
/src/libevent/test/test-ratelim.c	[]	[]
/src/tmux/window-tree.c	[]	[]
/src/libevent/test/tinytest_demo.c	[]	[]
/src/tmux/cmd-queue.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['input-fuzzer']
/src/libevent/test/regress_mbedtls.c	[]	[]
/src/tmux/osdep-freebsd.c	[]	[]
/src/tmux/proc.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/evthread-internal.h	[]	[]
/src/libevent/evdns.c	[]	[]
/src/libevent/WIN32-Code/tree.h	[]	[]
/src/tmux/cmd-select-pane.c	[]	[]
/src/libevent/openssl-compat.h	[]	[]
/src/tmux/cmd-kill-pane.c	[]	[]
/src/tmux/cmd-load-buffer.c	[]	[]
/src/libevent/sample/https-client.c	[]	[]
/src/tmux/compat/recallocarray.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-lock-server.c	[]	[]
/src/tmux/compat/cfmakeraw.c	[]	[]
/src/tmux/cmd-command-prompt.c	[]	[]
/src/tmux/names.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/compat/sys/queue.h	[]	[]
/src/tmux/tty.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/layout.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/libevent/include/event2/buffer.h	[]	[]
/src/libevent/epoll_sub.c	[]	[]
/src/tmux/compat/systemd.c	['input-fuzzer']	[]
/src/libevent/listener.c	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/include/event2/event.h	[]	[]
/src/tmux/cmd-respawn-window.c	[]	[]
/src/libevent/poll.c	[]	[]
/src/tmux/options.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/compat/base64.c	[]	[]
/src/tmux/input-keys.c	[]	[]
/src/libevent/bufferevent_ratelim.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/compat/getopt_long.c	[]	[]
/src/tmux/fuzz/cmd-parse-fuzzer.c	['cmd-parse-fuzzer']	['cmd-parse-fuzzer']
/src/tmux/cmd-resize-pane.c	[]	[]
/src/tmux/cmd-detach-client.c	[]	[]
/src/libevent/include/event2/keyvalq_struct.h	[]	[]
/src/libevent/event_tagging.c	[]	[]
/src/libevent/sample/watch-timing.c	[]	[]
/src/libevent/evthread_win32.c	[]	[]
/src/tmux/compat/imsg-buffer.c	['input-fuzzer']	[]
/src/tmux/cmd-show-messages.c	[]	[]
/src/libevent/arc4random.c	[]	[]
/src/tmux/compat/daemon-darwin.c	[]	[]
/src/libevent/bufferevent_filter.c	[]	[]
/src/libevent/test/regress_thread.h	[]	[]
/src/libevent/test/bench_http.c	[]	[]
/src/tmux/compat/utf8proc.c	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/log.c	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/tty-term.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/fuzz/style-fuzzer.c	['style-fuzzer']	['style-fuzzer']
/src/tmux/compat/clock_gettime.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/compat/memmem.c	[]	[]
/src/tmux/compat/getdtablecount.c	[]	[]
/src/tmux/format-draw.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer']
/src/tmux/window-copy.c	[]	[]
/src/tmux/cmd-rotate-window.c	[]	[]
/src/tmux/cmd-swap-window.c	[]	[]
/src/tmux/compat/getline.c	[]	[]
/src/tmux/compat/freezero.c	['input-fuzzer']	[]
/src/libevent/evthread.c	[]	[]
/src/tmux/compat/vis.c	['json-fuzzer', 'style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-split-window.c	[]	[]
/src/tmux/cmd-move-window.c	[]	[]
/src/tmux/cmd-select-layout.c	[]	[]
/src/libevent/bufferevent_mbedtls.c	[]	[]
/src/tmux/file.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/evutil_time.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/epoll.c	[]	[]
/src/tmux/tmux.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd.c	['cmd-parse-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['cmd-parse-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-refresh-client.c	[]	[]
/src/tmux/cmd-select-window.c	[]	[]
/src/tmux/server-acl.c	[]	[]
/src/tmux/cmd-resize-window.c	[]	[]
/src/tmux/sort.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer']
/src/tmux/compat/explicit_bzero.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/layout-set.c	[]	[]
/src/tmux/compat/getdtablesize.c	[]	[]
/src/tmux/cmd-list-buffers.c	[]	[]
/src/tmux/prompt-history.c	[]	[]
/src/libevent/bufferevent_async.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/http.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/window-buffer.c	[]	[]
/src/tmux/grid-reader.c	[]	[]
/src/tmux/fuzzy.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['format-fuzzer']
/src/libevent/test/regress_ws.c	['layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/sample/hello-world.c	[]	[]
/src/libevent/evutil.c	['json-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/tmux/menu.c	['layout-fuzzer', 'input-fuzzer']	['layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-break-pane.c	[]	[]
/src/tmux/hyperlinks.c	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	['style-fuzzer', 'format-fuzzer', 'layout-fuzzer', 'input-fuzzer']
/src/tmux/cmd-list-windows.c	[]	[]
/src/tmux/cmd-paste-buffer.c	[]	[]
/src/tmux/cmd-set-buffer.c	[]	[]
/src/tmux/window-clock.c	['format-fuzzer', 'layout-fuzzer', 'input-fuzzer']	[]
/src/libevent/strlcpy.c	[]	[]
/src/libevent/bufferevent_openssl.c	[]	[]

Directories in report

Directory
/src/tmux/fuzz/
/src/libevent/
/src/libevent/WIN32-Code/
/src/libevent/test/
/src/libevent/test-export/
/src/tmux/compat/
/src/libevent/compat/sys/
/src/tmux/
/src/libevent/include/event2/
/src/libevent/sample/

This section shows a list of 3rd party function calls and their relative coverage information. By static analysis of the target project code, all of the 3rd party function call and their caller information, including the source file and line number that initiate the call are captured. The caller source code file and line number are shown in column 2 while column 1 is the function name of the 3rd party function call. Each occurrent of the 3rd party function call will occuply a separate row. Column 3 of each row indicate if the 3rd party call in the source file line is unreachable. Column 4 lists all fuzzers that have covered that particular system call in that specific location (source file and line)during their dynamic fuzzing.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Covered by Fuzzers

This section contains multiple tables, each table contains a list of sink functions/methods found in the project for one of the CWE supported by the sink analyser, together with information like which fuzzers statically reach the sink functions/methods and possible call path to that sink functions/methods if it is not statically reached by any fuzzers. Column 1 is the function/method name of the sink functions/methods found in the project. Column 2 lists all fuzzers (or no fuzzers at all) that have covered that particular function method statically. Column 3 shows a list of possible call paths to reach the specific function/method call if none of the fuzzers cover the target function/method calls. Lastly, column 4 shows possible fuzzer blockers that prevent an existing fuzzer from reaching the target sink functions/methods dynamically.

Sink functions/methods found for CWE787

Target sink	Reached by fuzzer	Function call path	Possible branch blockers
xmalloc	['style-fuzzer', 'layout-fuzzer', 'format-fuzzer', 'json-fuzzer', 'input-fuzzer']	N/A	Blocker function Arguments type Return type Constants touched window_set_active_pane in /src/tmux/window.c:756 ['struct window*', 'struct window_pane*', 'int'] int [] window_clock_key in /src/tmux/window-clock.c:215 ['struct window_mode_entry*', '__unused*', '__unused*', '__unused*', '__unused', '__unused*'] void [] cmd_choose_tree_exec in /src/tmux/cmd-choose-tree.c:135 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_choose_tree_read_done in /src/tmux/cmd-choose-tree.c:179 ['__unused*', 'char*', 'int', 'int', 'struct evbuffer*', 'void*'] void [] cmd_copy_mode_exec in /src/tmux/cmd-copy-mode.c:58 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_run_shell_callback in /src/tmux/cmd-run-shell.c:249 ['struct job*'] void [] cmd_attach_session_exec in /src/tmux/cmd-attach-session.c:192 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_new_session_exec in /src/tmux/cmd-new-session.c:69 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cfg_done in /src/tmux/cfg.c:50 ['__unused*', '__unused*'] enum cmd_retval [] cmd_display_message_exec in /src/tmux/cmd-display-message.c:61 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_save_buffer_exec in /src/tmux/cmd-save-buffer.c:74 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_break_pane_exec in /src/tmux/cmd-break-pane.c:90 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_show_options_exec in /src/tmux/cmd-show-options.c:92 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_server_access_exec in /src/tmux/cmd-server-access.c:61 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_new_window_exec in /src/tmux/cmd-new-window.c:53 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_list_panes_exec in /src/tmux/cmd-list-panes.c:52 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_wait_for_event_cb in /src/tmux/cmd-wait-for.c:226 ['__unused*', 'struct event_payload*', 'void*'] void [] cmd_wait_for_exec in /src/tmux/cmd-wait-for.c:183 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_select_pane_exec in /src/tmux/cmd-select-pane.c:148 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_split_window_exec in /src/tmux/cmd-split-window.c:77 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_show_messages_exec in /src/tmux/cmd-show-messages.c:74 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_list_keys_exec in /src/tmux/cmd-list-keys.c:167 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_show_prompt_history_exec in /src/tmux/cmd-show-prompt-history.c:54 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_list_windows_exec in /src/tmux/cmd-list-windows.c:59 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_list_buffers_exec in /src/tmux/cmd-list-buffers.c:47 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_display_message_each in /src/tmux/cmd-display-message.c:53 ['char*', 'char*', 'void*'] void [] cmd_show_environment_exec in /src/tmux/cmd-show-environment.c:98 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_source_file_complete_cb in /src/tmux/cmd-source-file.c:78 ['struct cmdq_item*', 'void*'] enum cmd_retval [] cmd_list_sessions_exec in /src/tmux/cmd-list-sessions.c:53 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_list_clients_exec in /src/tmux/cmd-list-clients.c:54 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] format_log1 in /src/tmux/format.c:290 ['struct format_expand_state*', 'char*', 'char*'] void [] cmd_list_commands in /src/tmux/cmd-list-commands.c:101 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_find_window_exec in /src/tmux/cmd-find-window.c:45 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_respawn_window_exec in /src/tmux/cmd-respawn-window.c:48 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] window_copy_cmd_open_selection in /src/tmux/window-copy.c:2969 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_open_output in /src/tmux/window-copy.c:2989 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_customize_menu in /src/tmux/window-customize.c:1540 ['void*', 'struct client*', 'key_code'] void [] window_buffer_menu in /src/tmux/window-buffer.c:283 ['void*', 'struct client*', 'key_code'] void [] cmd_display_popup_exec in /src/tmux/cmd-display-menu.c:446 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_respawn_pane_exec in /src/tmux/cmd-respawn-pane.c:48 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_capture_pane_exec in /src/tmux/cmd-capture-pane.c:416 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] window_panes_timer_callback in /src/tmux/window-panes.c:876 ['__unused', '__unused short', 'void*'] void [] window_panes_key in /src/tmux/window-panes.c:1075 ['struct window_mode_entry*', 'struct client*', '__unused*', '__unused*', 'key_code', 'struct mouse_event*'] void [] window_switch_key in /src/tmux/window-switch.c:598 ['struct window_mode_entry*', 'struct client*', '__unused*', '__unused*', 'key_code', 'struct mouse_event*'] void [] window_copy_cmd_scroll_to_mouse in /src/tmux/window-copy.c:1820 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_command in /src/tmux/window-copy.c:4187 ['struct window_mode_entry*', 'struct client*', 'struct session*', 'struct winlink*', 'struct args*', 'struct mouse_event*'] void [] window_client_menu in /src/tmux/window-client.c:361 ['void*', 'struct client*', 'key_code'] void [] window_tree_menu in /src/tmux/window-tree.c:963 ['void*', 'struct client*', 'key_code'] void [] server_client_key_callback in /src/tmux/server-client.c:1378 ['struct cmdq_item*', 'void*'] enum cmd_retval [] cmd_send_keys_exec in /src/tmux/cmd-send-keys.c:162 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] tty_read_callback in /src/tmux/tty.c:176 ['__unused', '__unused short', 'void*'] void [] tty_keys_callback in /src/tmux/tty-keys.c:1019 ['__unused', '__unused short', 'void*'] void [] server_client_click_timer in /src/tmux/server-client.c:2281 ['__unused', '__unused short', 'void*'] void [] window_tree_kill_current_callback in /src/tmux/window-tree.c:1335 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] cmd_kill_pane_exec in /src/tmux/cmd-kill-pane.c:49 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] window_pane_error_callback in /src/tmux/window.c:1726 ['__unused*', '__unused short', 'void*'] void [] server_signal in /src/tmux/server.c:439 ['int'] void [] cmd_pipe_pane_exec in /src/tmux/cmd-pipe-pane.c:56 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_pipe_pane_read_callback in /src/tmux/cmd-pipe-pane.c:194 ['__unused*', 'void*'] void [] cmd_pipe_pane_write_callback in /src/tmux/cmd-pipe-pane.c:215 ['__unused*', 'void*'] void [] cmd_pipe_pane_error_callback in /src/tmux/cmd-pipe-pane.c:226 ['__unused*', '__unused short', 'void*'] void [] cmd_rotate_window_exec in /src/tmux/cmd-rotate-window.c:44 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_swap_pane_exec in /src/tmux/cmd-swap-pane.c:62 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] window_panes_init in /src/tmux/window-panes.c:884 ['struct window_mode_entry*', 'struct cmdq_item*', '__unused*', 'struct args*'] struct screen [] window_switch_init in /src/tmux/window-switch.c:368 ['struct window_mode_entry*', '__unused*', 'struct cmd_find_state*', 'struct args*'] struct screen [] cmd_join_pane_exec in /src/tmux/cmd-join-pane.c:435 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_kill_window_exec in /src/tmux/cmd-kill-window.c:62 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_kill_session_exec in /src/tmux/cmd-kill-session.c:51 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_move_window_exec in /src/tmux/cmd-move-window.c:61 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] server_client_dispatch in /src/tmux/server-client.c:2630 ['struct imsg*', 'void*'] void [] server_client_exit_timer in /src/tmux/server-client.c:2316 ['__unused', '__unused short', 'void*'] void [] recalculate_size in /src/tmux/resize.c:364 ['struct window*', 'int'] void [] cmd_set_option_exec in /src/tmux/cmd-set-option.c:229 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] window_customize_edit_close_cb in /src/tmux/window-customize.c:1979 ['char*', 'size_t', 'void*'] void [] window_customize_set_option_callback in /src/tmux/window-customize.c:1695 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_add_option_callback in /src/tmux/window-customize.c:1830 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_set_array_key_callback in /src/tmux/window-customize.c:2258 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_change_each in /src/tmux/window-customize.c:2626 ['void*', 'void*', '__unused*', '__unused'] void [] window_customize_change_current_callback in /src/tmux/window-customize.c:2658 ['__unused*', 'void*', 'char*', '__unused'] enum prompt_result [] cmd_refresh_client_exec in /src/tmux/cmd-refresh-client.c:176 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] server_loop in /src/tmux/server.c:271 [] int [] window_customize_init in /src/tmux/window-customize.c:1595 ['struct window_mode_entry*', '__unused*', 'struct cmd_find_state*', 'struct args*'] struct screen [] window_buffer_init in /src/tmux/window-buffer.c:365 ['struct window_mode_entry*', '__unused*', 'struct cmd_find_state*', 'struct args*'] struct screen [] window_client_init in /src/tmux/window-client.c:432 ['struct window_mode_entry*', '__unused*', '__unused*', 'struct args*'] struct screen [] window_tree_init in /src/tmux/window-tree.c:1106 ['struct window_mode_entry*', '__unused*', 'struct cmd_find_state*', 'struct args*'] struct screen [] cmd_resize_pane_exec in /src/tmux/cmd-resize-pane.c:55 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] window_panes_free in /src/tmux/window-panes.c:962 ['struct window_mode_entry*'] void [] window_switch_free in /src/tmux/window-switch.c:474 ['struct window_mode_entry*'] void [] window_customize_free in /src/tmux/window-customize.c:1646 ['struct window_mode_entry*'] void [] window_buffer_free in /src/tmux/window-buffer.c:403 ['struct window_mode_entry*'] void [] window_client_free in /src/tmux/window-client.c:476 ['struct window_mode_entry*'] void [] window_tree_free in /src/tmux/window-tree.c:1178 ['struct window_mode_entry*'] void [] layout_set_even_h in /src/tmux/layout-set.c:205 ['struct window*'] void [] layout_set_even_v in /src/tmux/layout-set.c:211 ['struct window*'] void [] window_pane_resize in /src/tmux/window.c:1767 ['struct window_pane*', 'u_int', 'u_int'] void [] cmd_load_buffer_exec in /src/tmux/cmd-load-buffer.c:91 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_source_file_done in /src/tmux/cmd-source-file.c:116 ['__unused*', 'char*', 'int', 'int', 'struct evbuffer*', 'void*'] void [] cmd_source_file_exec in /src/tmux/cmd-source-file.c:175 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_rename_window_exec in /src/tmux/cmd-rename-window.c:46 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_save_buffer_done in /src/tmux/cmd-save-buffer.c:60 ['__unused*', 'char*', 'int', '__unused', '__unused*', 'void*'] void [] hooks_event_cb in /src/tmux/hooks.c:234 ['char*', 'struct event_payload*', '__unused*'] void [] hooks_monitor_hook_cb in /src/tmux/hooks.c:358 ['char*', 'struct event_payload*', 'void*'] void [] cmd_set_environment_exec in /src/tmux/cmd-set-environment.c:47 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] key_bindings_read_only in /src/tmux/key-bindings.c:760 ['struct cmdq_item*', '__unused*'] enum cmd_retval [] cmd_run_shell_exec in /src/tmux/cmd-run-shell.c:109 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_run_shell_timer in /src/tmux/cmd-run-shell.c:193 ['__unused', '__unused short', 'void*'] void [] cmd_confirm_before_exec in /src/tmux/cmd-confirm-before.c:67 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_if_shell_exec in /src/tmux/cmd-if-shell.c:73 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_bind_key_exec in /src/tmux/cmd-bind-key.c:55 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_rename_session_exec in /src/tmux/cmd-rename-session.c:47 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_unbind_key_exec in /src/tmux/cmd-unbind-key.c:43 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_set_buffer_exec in /src/tmux/cmd-set-buffer.c:57 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] server_client_read_only in /src/tmux/server-client.c:2747 ['struct cmdq_item*', '__unused*'] enum cmd_retval [] cmd_display_menu_exec in /src/tmux/cmd-display-menu.c:330 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_paste_buffer_exec in /src/tmux/cmd-paste-buffer.c:58 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_load_buffer_done in /src/tmux/cmd-load-buffer.c:54 ['__unused*', 'char*', 'int', 'int', 'struct evbuffer*', 'void*'] void [] cmd_command_prompt_exec in /src/tmux/cmd-command-prompt.c:83 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmd_detach_client_exec in /src/tmux/cmd-detach-client.c:59 ['struct cmd*', 'struct cmdq_item*'] enum cmd_retval [] cmdq_error_callback in /src/tmux/cmd-queue.c:688 ['struct cmdq_item*', 'void*'] enum cmd_retval [] cmd_if_shell_callback in /src/tmux/cmd-if-shell.c:139 ['struct job*'] void [] file_push_cb in /src/tmux/file.c:463 ['__unused', '__unused short', 'void*'] void [] file_read_callback in /src/tmux/file.c:726 ['__unused*', 'void*'] void [] tty_cmd_setselection in /src/tmux/tty.c:1977 ['struct tty*', 'struct tty_ctx*'] void [] sixel_draw_rect in /src/tmux/image-sixel.c:1503 ['struct tty*', 'struct image_rect*'] void [] cmd_command_prompt_callback in /src/tmux/cmd-command-prompt.c:198 ['struct client*', 'void*', 'char*', 'enum prompt_key_result'] enum prompt_result [] window_customize_set_environment_callback in /src/tmux/window-customize.c:1751 ['__unused*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_add_environment_callback in /src/tmux/window-customize.c:1917 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_set_command_callback in /src/tmux/window-customize.c:2390 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_set_note_callback in /src/tmux/window-customize.c:2429 ['__unused*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_add_key_callback in /src/tmux/window-customize.c:2507 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_customize_change_tagged_callback in /src/tmux/window-customize.c:2704 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_buffer_update in /src/tmux/window-buffer.c:438 ['struct window_mode_entry*'] void [] window_buffer_edit_close_cb in /src/tmux/window-buffer.c:535 ['char*', 'size_t', 'void*'] void [] window_customize_resize in /src/tmux/window-customize.c:1663 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] window_buffer_resize in /src/tmux/window-buffer.c:430 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] window_client_resize in /src/tmux/window-client.c:498 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] window_tree_resize in /src/tmux/window-tree.c:1191 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] mode_tree_prompt_accept in /src/tmux/mode-tree.c:1095 ['struct cmdq_item*', 'void*'] enum cmd_retval [] mode_tree_search_callback in /src/tmux/mode-tree.c:1301 ['__unused*', 'void*', 'char*', 'enum prompt_key_result'] enum prompt_result [] mode_tree_filter_callback in /src/tmux/mode-tree.c:1324 ['__unused*', 'void*', 'char*', 'enum prompt_key_result'] enum prompt_result [] window_client_update in /src/tmux/window-client.c:506 ['struct window_mode_entry*'] void [] window_tree_update in /src/tmux/window-tree.c:1199 ['struct window_mode_entry*'] void [] window_tree_command_done in /src/tmux/window-tree.c:1262 ['__unused*', 'void*'] enum cmd_retval [] window_switch_resize in /src/tmux/window-switch.c:500 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] status_prompt_accept in /src/tmux/status.c:764 ['__unused*', 'void*'] enum cmd_retval [] window_switch_prompt_callback in /src/tmux/window-switch.c:575 ['void*', 'char*', 'enum prompt_key_result'] enum prompt_result [] format_replace in /src/tmux/format.c:6081 ['struct format_expand_state*', 'char*', 'size_t', 'char**', 'size_t*', 'size_t*'] int [] window_copy_init in /src/tmux/window-copy.c:633 ['struct window_mode_entry*', '__unused*', '__unused*', 'struct args*'] struct screen [] window_copy_resize in /src/tmux/window-copy.c:1260 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] window_copy_refresh_timer in /src/tmux/window-copy.c:3368 ['__unused', '__unused short', 'void*'] void [] window_copy_cmd_refresh_now in /src/tmux/window-copy.c:3417 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_scroll_bottom in /src/tmux/window-copy.c:1798 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_scroll_middle in /src/tmux/window-copy.c:1809 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_scroll_top in /src/tmux/window-copy.c:1837 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_scroll_down in /src/tmux/window-copy.c:2563 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_scroll_down_and_cancel in /src/tmux/window-copy.c:2599 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_recentre_top_bottom in /src/tmux/window-copy.c:3462 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_scroll_timer in /src/tmux/window-copy.c:397 ['__unused', '__unused short', 'void*'] void [] window_copy_cmd_copy_end_of_line in /src/tmux/window-copy.c:1484 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_end_of_line_and_cancel in /src/tmux/window-copy.c:1490 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_pipe_end_of_line in /src/tmux/window-copy.c:1496 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_pipe_end_of_line_and_cancel in /src/tmux/window-copy.c:1502 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_line in /src/tmux/window-copy.c:1572 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_line_and_cancel in /src/tmux/window-copy.c:1578 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_pipe_line in /src/tmux/window-copy.c:1584 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_pipe_line_and_cancel in /src/tmux/window-copy.c:1590 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_cursor_down in /src/tmux/window-copy.c:1717 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_cursor_down_and_cancel in /src/tmux/window-copy.c:1728 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_select_line in /src/tmux/window-copy.c:2688 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_begin_selection in /src/tmux/window-copy.c:1363 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_drag_release in /src/tmux/window-copy.c:7753 ['struct client*', 'struct mouse_event*'] void [] window_copy_cmd_halfpage_up in /src/tmux/window-copy.c:1913 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_page_up in /src/tmux/window-copy.c:2450 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_halfpage_down in /src/tmux/window-copy.c:1885 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_halfpage_down_and_cancel in /src/tmux/window-copy.c:1899 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_page_down in /src/tmux/window-copy.c:2423 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_page_down_and_cancel in /src/tmux/window-copy.c:2437 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_end_of_line in /src/tmux/window-copy.c:1876 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_cursor_right in /src/tmux/window-copy.c:1754 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_jump_again in /src/tmux/window-copy.c:1981 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_jump_reverse in /src/tmux/window-copy.c:2009 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_jump_forward in /src/tmux/window-copy.c:3035 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_jump_to_forward in /src/tmux/window-copy.c:3071 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_next_space in /src/tmux/window-copy.c:2268 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_next_word in /src/tmux/window-copy.c:2290 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_next_matching_bracket in /src/tmux/window-copy.c:2136 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_next_space_end in /src/tmux/window-copy.c:2279 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_next_word_end in /src/tmux/window-copy.c:2304 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_select_word in /src/tmux/window-copy.c:2717 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_scroll_up in /src/tmux/window-copy.c:2624 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_cursor_up in /src/tmux/window-copy.c:1843 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_start_of_line in /src/tmux/window-copy.c:2777 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_back_to_indentation in /src/tmux/window-copy.c:1354 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_cursor_left in /src/tmux/window-copy.c:1743 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_jump_backward in /src/tmux/window-copy.c:3017 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_jump_to_backward in /src/tmux/window-copy.c:3053 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_previous_space in /src/tmux/window-copy.c:2472 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_previous_word in /src/tmux/window-copy.c:2483 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_previous_paragraph in /src/tmux/window-copy.c:2461 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_next_paragraph in /src/tmux/window-copy.c:2257 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_select_output in /src/tmux/window-copy.c:1639 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_selection_mode in /src/tmux/window-copy.c:2331 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_again in /src/tmux/window-copy.c:2654 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_reverse in /src/tmux/window-copy.c:2671 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_backward in /src/tmux/window-copy.c:3116 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_backward_text in /src/tmux/window-copy.c:3136 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_backward_incremental in /src/tmux/window-copy.c:3196 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_forward_incremental in /src/tmux/window-copy.c:3249 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_forward in /src/tmux/window-copy.c:3156 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_search_forward_text in /src/tmux/window-copy.c:3176 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_goto_line in /src/tmux/window-copy.c:3006 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_line_numbers_on in /src/tmux/window-copy.c:3518 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_line_numbers_off in /src/tmux/window-copy.c:3525 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_line_numbers_toggle in /src/tmux/window-copy.c:3532 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_style_changed in /src/tmux/window-copy.c:6016 ['struct window_mode_entry*'] void [] window_copy_cmd_centre_vertical in /src/tmux/window-copy.c:1854 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_centre_horizontal in /src/tmux/window-copy.c:1865 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_append_selection in /src/tmux/window-copy.c:1330 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_append_selection_and_cancel in /src/tmux/window-copy.c:1342 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_clear_selection in /src/tmux/window-copy.c:1413 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_selection in /src/tmux/window-copy.c:1619 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_selection_and_cancel in /src/tmux/window-copy.c:1629 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_output in /src/tmux/window-copy.c:1687 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_pipe in /src/tmux/window-copy.c:2826 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_pipe_and_cancel in /src/tmux/window-copy.c:2836 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_pipe in /src/tmux/window-copy.c:2865 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_pipe_and_cancel in /src/tmux/window-copy.c:2875 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_copy_pipe_output in /src/tmux/window-copy.c:2885 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_pipe_output in /src/tmux/window-copy.c:2920 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_rectangle_on in /src/tmux/window-copy.c:2497 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_rectangle_off in /src/tmux/window-copy.c:2509 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_rectangle_toggle in /src/tmux/window-copy.c:2521 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_bottom_line in /src/tmux/window-copy.c:1394 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_history_bottom in /src/tmux/window-copy.c:1934 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_history_top in /src/tmux/window-copy.c:1958 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_middle_line in /src/tmux/window-copy.c:2037 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_top_line in /src/tmux/window-copy.c:2786 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_other_end in /src/tmux/window-copy.c:2318 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_next_prompt in /src/tmux/window-copy.c:3098 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_previous_prompt in /src/tmux/window-copy.c:3107 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_copy_cmd_jump_to_mark in /src/tmux/window-copy.c:3089 ['struct window_copy_cmd_state*'] enum window_copy_cmd_action [] window_customize_build in /src/tmux/window-customize.c:1063 ['void*', '__unused*', '__unused*', 'char*'] void [] window_customize_draw in /src/tmux/window-customize.c:1522 ['void*', 'void*', 'struct screen_write_ctx*', 'u_int', 'u_int'] void [] window_panes_resize in /src/tmux/window-panes.c:987 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] window_client_draw in /src/tmux/window-client.c:305 ['void*', 'void*', 'struct screen_write_ctx*', 'u_int', 'u_int'] void [] window_tree_draw in /src/tmux/window-tree.c:882 ['void*', 'void*', 'struct screen_write_ctx*', 'u_int', 'u_int'] void [] window_customize_update in /src/tmux/window-customize.c:1671 ['struct window_mode_entry*'] void [] window_tree_kill_tagged_callback in /src/tmux/window-tree.c:1354 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] window_pane_read_callback in /src/tmux/window.c:1698 ['__unused*', 'void*'] void [] tty_keys_clipboard in /src/tmux/tty-keys.c:1295 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] tty_keys_palette in /src/tmux/tty-keys.c:1856 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] window_clock_timer_callback in /src/tmux/window-clock.c:147 ['__unused', '__unused short', 'void*'] void [] window_clock_init in /src/tmux/window-clock.c:171 ['struct window_mode_entry*', '__unused*', '__unused*', '__unused*'] struct screen [] window_clock_resize in /src/tmux/window-clock.c:205 ['struct window_mode_entry*', 'u_int', 'u_int'] void [] window_buffer_draw in /src/tmux/window-buffer.c:199 ['__unused*', 'void*', 'struct screen_write_ctx*', 'u_int', 'u_int'] void [] input_dcs_dispatch in /src/tmux/input.c:2626 ['struct input_ctx*'] int [] monitor_timer in /src/tmux/monitor.c:494 ['__unused', '__unused short', 'void*'] void [] tty_keys_colours1 in /src/tmux/tty-keys.c:1832 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] window_tree_build in /src/tmux/window-tree.c:429 ['void*', 'struct sort_criteria*', 'uint64_t*', 'char*'] void [] key_bindings_reset_table in /src/tmux/key-bindings.c:344 ['char*'] void [] server_client_repeat_timer in /src/tmux/server-client.c:2268 ['__unused', '__unused short', 'void*'] void [] client_main in /src/tmux/client.c:231 ['struct event_base*', 'int', 'char**', 'uint64_t', 'int'] int [] server_accept in /src/tmux/server.c:376 ['int', 'short', '__unused*'] void [] client_dispatch in /src/tmux/client.c:576 ['struct imsg*', '__unused*'] void [] control_pane_mode_changed_cb in /src/tmux/control-notify.c:34 ['__unused*', 'struct event_payload*', '__unused*'] void [] xmemdup in /src/tmux/xmalloc.c:106 ['void*', 'size_t'] char [] layout_string_init in /src/tmux/layout-custom.c:153 ['struct layout_string*'] void [] screen_print in /src/tmux/screen.c:812 ['struct screen*', 'int'] char [] window_tree_command_each in /src/tmux/window-tree.c:1247 ['void*', 'void*', 'struct client*', '__unused'] void [] utf8_padcstr in /src/tmux/utf8.c:985 ['char*', 'u_int'] char [] utf8_rpadcstr in /src/tmux/utf8.c:1006 ['char*', 'u_int'] char [] format_job_complete in /src/tmux/format.c:357 ['struct job*'] void [] format_add in /src/tmux/format.c:4430 ['struct format_tree*', 'char*', 'char*'] void [] format_quote_shell_single in /src/tmux/format.c:4521 ['char*'] char [] xvasprintf in /src/tmux/xmalloc.c:130 ['char**', 'char*', 'va_list'] int [] make_label in /src/tmux/tmux.c:227 ['char*', 'char**'] char [] format_cb_start_command in /src/tmux/format.c:900 ['struct format_tree*'] void [] format_cb_current_command in /src/tmux/format.c:957 ['struct format_tree*'] void [] options_match_get in /src/tmux/options.c:866 ['struct options*', 'char*', 'char**', 'int', 'int*'] struct options_entry [] control_error in /src/tmux/control.c:672 ['struct cmdq_item*', 'void*'] enum cmd_retval [] cmd_confirm_before_callback in /src/tmux/cmd-confirm-before.c:122 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] server_client_default_command in /src/tmux/server-client.c:2755 ['struct cmdq_item*', '__unused*'] enum cmd_retval [] control_window_pane_changed_cb in /src/tmux/control-notify.c:110 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_window_unlinked_cb in /src/tmux/control-notify.c:129 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_window_linked_cb in /src/tmux/control-notify.c:154 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_window_renamed_cb in /src/tmux/control-notify.c:179 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_client_session_changed_cb in /src/tmux/control-notify.c:205 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_client_detached_cb in /src/tmux/control-notify.c:233 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_session_renamed_cb in /src/tmux/control-notify.c:250 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_session_created_cb in /src/tmux/control-notify.c:268 ['__unused*', '__unused*', '__unused*'] void [] control_session_closed_cb in /src/tmux/control-notify.c:282 ['__unused*', '__unused*', '__unused*'] void [] control_session_window_changed_cb in /src/tmux/control-notify.c:296 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_paste_buffer_changed_cb in /src/tmux/control-notify.c:320 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_paste_buffer_deleted_cb in /src/tmux/control-notify.c:337 ['__unused*', 'struct event_payload*', '__unused*'] void [] control_write_callback in /src/tmux/control.c:925 ['__unused*', 'void*'] void [] control_sub_change in /src/tmux/control.c:962 ['struct monitor_change*', '__unused*'] void [] log_debug in /src/tmux/log.c:125 ['char*'] void [] tty_keys_device_attributes2 in /src/tmux/tty-keys.c:1597 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] tty_keys_extended_device_attributes in /src/tmux/tty-keys.c:1678 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] tty_keys_device_attributes in /src/tmux/tty-keys.c:1412 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] tty_keys_sync in /src/tmux/tty-keys.c:1497 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] tty_keys_kitty_graphics in /src/tmux/tty-keys.c:1549 ['struct tty*', 'char*', 'size_t', 'size_t*', 'int'] int [] tty_start_timer_callback in /src/tmux/tty.c:318 ['__unused', '__unused short', 'void*'] void [] client_file_check_cb in /src/tmux/client.c:566 ['__unused*', '__unused*', '__unused', '__unused', '__unused*', '__unused*'] void [] tty_write_callback in /src/tmux/tty.c:251 ['__unused', '__unused short', 'void*'] void [] server_client_command_done in /src/tmux/server-client.c:2773 ['struct cmdq_item*', '__unused*'] enum cmd_retval [] tty_cmd_alignmenttest in /src/tmux/tty.c:1902 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_cells in /src/tmux/tty.c:1946 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_cell in /src/tmux/tty.c:1924 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_insertcharacter in /src/tmux/tty.c:1572 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_deletecharacter in /src/tmux/tty.c:1591 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_clearcharacter in /src/tmux/tty.c:1610 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_insertline in /src/tmux/tty.c:1618 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_deleteline in /src/tmux/tty.c:1642 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_clearline in /src/tmux/tty.c:1666 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_clearendofline in /src/tmux/tty.c:1674 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_clearstartofline in /src/tmux/tty.c:1684 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_reverseindex in /src/tmux/tty.c:1692 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_linefeed in /src/tmux/tty.c:1724 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_scrollup in /src/tmux/tty.c:1765 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_scrolldown in /src/tmux/tty.c:1803 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_clearendofscreen in /src/tmux/tty.c:1836 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_clearstartofscreen in /src/tmux/tty.c:1860 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_clearscreen in /src/tmux/tty.c:1884 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_redrawline in /src/tmux/tty.c:1453 ['struct tty*', 'struct tty_ctx*'] void [] tty_cmd_rawstring in /src/tmux/tty.c:2005 ['struct tty*', 'struct tty_ctx*'] void [] sixel_start_draw in /src/tmux/image-sixel.c:1531 ['struct tty*', 'u_int', 'u_int', 'u_int', 'u_int'] void [] tty_cmd_syncstart in /src/tmux/tty.c:2013 ['struct tty*', 'struct tty_ctx*'] void [] tty_update_window_offset in /src/tmux/tty.c:1071 ['struct window*'] void [] options_remove in /src/tmux/options.c:406 ['struct options_entry*'] void [] format_cb_mouse_word in /src/tmux/format.c:1309 ['struct format_tree*'] void [] format_cb_mouse_hyperlink in /src/tmux/format.c:1334 ['struct format_tree*'] void [] format_cb_mouse_line in /src/tmux/format.c:1359 ['struct format_tree*'] void [] window_copy_cursor_word_cb in /src/tmux/window-copy.c:1113 ['struct format_tree*'] void [] window_copy_cursor_line_cb in /src/tmux/window-copy.c:1123 ['struct format_tree*'] void [] window_copy_search_match_cb in /src/tmux/window-copy.c:1133 ['struct format_tree*'] void [] window_copy_cursor_hyperlink_cb in /src/tmux/window-copy.c:1101 ['struct format_tree*'] void [] client_signal in /src/tmux/client.c:512 ['int'] void [] job_error_callback in /src/tmux/job.c:338 ['__unused*', '__unused short', 'void*'] void [] server_tidy_event in /src/tmux/server.c:158 ['__unused', '__unused short', '__unused*'] void [] file_fire_done_cb in /src/tmux/file.c:155 ['__unused', '__unused short', 'void*'] void [] mode_tree_collapse_current in /src/tmux/mode-tree.c:470 ['struct mode_tree_data*'] void [] format_cb_buffer_sample in /src/tmux/format.c:1514 ['struct format_tree*'] void [] window_tree_command_callback in /src/tmux/window-tree.c:1276 ['struct client*', 'void*', 'char*', '__unused'] enum prompt_result [] image_grid_add in /src/tmux/image-grid.c:426 ['struct grid*', 'struct image*', 'u_int', 'u_int', 'u_int', 'u_int', 'u_int', 'u_int'] void [] xcalloc in /src/tmux/xmalloc.c:39 ['size_t', 'size_t'] void [] xreallocarray in /src/tmux/xmalloc.c:60 ['void*', 'size_t', 'size_t'] void [] regsub in /src/tmux/regsub.c:61 ['char*', 'char*', 'char*', 'int'] char [] xstrdup in /src/tmux/xmalloc.c:86 ['char*'] char [] xstrndup in /src/tmux/xmalloc.c:96 ['char*', 'size_t'] char [] window_tree_search in /src/tmux/window-tree.c:917 ['__unused*', 'void*', 'char*', 'int'] int [] fallback_map_cell in /src/tmux/image-fallback.c:157 ['struct tty*', 'struct grid*', 'u_int', 'u_int', 'struct grid_cell*', 'struct grid_cell*', 'int*'] struct grid_cell [] sixel_get_flags in /src/tmux/image-sixel.c:1435 ['struct tty*'] int [] grid_free_line in /src/tmux/grid.c:306 ['struct grid*', 'u_int'] void [] mode_tree_menu_callback in /src/tmux/mode-tree.c:1360 ['__unused*', '__unused', 'key_code', 'void*'] void [] status_message_callback in /src/tmux/status.c:655 ['__unused', '__unused short', 'void*'] void [] sixel_free_pending in /src/tmux/image-sixel.c:1459 ['struct tty*'] void [] kitty_remove_image in /src/tmux/image-kitty.c:270 ['struct image*'] void [] sort_pane_cmp in /src/tmux/sort.c:205 ['void*', 'void*'] int [] options_get_number in /src/tmux/options.c:902 ['struct options*', 'char*'] long long [] asprintf in /src/tmux/compat/asprintf.c:27 ['char**', 'char*'] int []
strndup	['format-fuzzer', 'layout-fuzzer', 'json-fuzzer', 'input-fuzzer']	N/A	N/A

Sink functions/methods found for CWE22

Target sink	Reached by fuzzer	Function call path	Possible branch blockers
write	[]	Path 1 Path 2	N/A