Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzer details

Fuzzer: unrar_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 818 34.2%
gold [1:9] 52 2.17%
yellow [10:29] 27 1.13%
greenyellow [30:49] 21 0.87%
lawngreen 50+ 1469 61.5%
All colors 2387 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
575 683 15 :

['ReadTextFile(std::__1::basic_string , std::__1::allocator > const&, StringList*, bool, bool, RAR_CHARSET, bool, bool, bool)', 'FindFile::FastFind(std::__1::basic_string , std::__1::allocator > const&, FindData*, bool)', 'FindData::FindData()', 'std::__1::basic_string , std::__1::allocator >::empty[abi:ne180100]() const', 'IsDriveDiv(int)', 'StringList::AddString(wchar_t const*)', '_ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEEC2B8ne180100ILi0EEEPKw', 'AddEndSlash(std::__1::basic_string , std::__1::allocator >&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'wcschr', 'wcslen', 'IsDriveLetter(std::__1::basic_string , std::__1::allocator > const&)', 'FindData::~FindData()', 'IsPathDiv(int)', 'IsWildcard(std::__1::basic_string , std::__1::allocator > const&)']

575 687 CommandData::ParseArg(wchar_tconst*) call site: 00000 /src/unrar/cmddata.cpp:102
33 35 2 :

['SubAllocator::AllocUnitsRare(int)', 'SubAllocator::RemoveNode(int)']

33 35 SubAllocator::AllocContext() call site: 00000 /src/unrar/./suballoc.cpp:249
33 35 2 :

['SubAllocator::U2B(int)', 'SubAllocator::AllocUnitsRare(int)']

33 35 SubAllocator::AllocUnits(int) call site: 00000 /src/unrar/./suballoc.cpp:240
27 27 1 :

['ErrorHandler::MemoryError()']

27 27 SubAllocator::StartSubAllocator(int) call site: 00000 /src/unrar/./suballoc.cpp:91
27 27 5 :

['FragmentedWindow::GetWinSize()', '__cxa_allocate_exception', 'FragmentedWindow::Init(unsigned long)', '__cxa_throw', 'std::bad_alloc::bad_alloc()']

27 27 Unpack::Init(unsignedlong,bool) call site: 00000 /src/unrar/unpack.cpp:137
16 40 4 :

['void uiMsg (UIMESSAGE_CODE, int&&)', 'cleandata(void*, unsigned long)', 'wcslen', 'SecPassword::Set(wchar_t const*)']

16 40 CommandData::ProcessSwitch(wchar_tconst*) call site: 00000 /src/unrar/cmddata.cpp:795
14 84 3 :

['FindFile::FastFind(std::__1::basic_string , std::__1::allocator > const&, FindData*, bool)', 'FindData::FindData()', 'FindData::~FindData()']

14 430 CmdExtract::ExtractArchive() call site: 00000 /src/unrar/extract.cpp:297
13 44 4 :

['mwcsicompc(wchar_t const*, wchar_t const*, bool)', 'wcschr', 'wcspbrk', 'match(wchar_t const*, wchar_t const*, bool)']

13 44 match(wchar_tconst*,wchar_tconst*,bool) call site: 00000 /src/unrar/match.cpp:99
8 5909 23 :

['Archive::Open(std::__1::basic_string , std::__1::allocator > const&, unsigned int)', 'Archive::Archive(CommandData*)', 'std::__1::basic_string , std::__1::allocator >::operator=(std::__1::basic_string , std::__1::allocator > const&)', 'Archive::SeekToNext()', 'bool std::__1::operator==[abi:ne180100] , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::basic_string , std::__1::allocator >::basic_string[abi:ne180100]()', 'CommandData::IsProcessFile(FileHeader&, bool*, int, bool, std::__1::basic_string , std::__1::allocator >*)', 'CmdExtract::AnalyzeData::~AnalyzeData()', 'std::__1::basic_string , std::__1::allocator >::clear[abi:ne180100]()', 'Archive::IsArchive(bool)', 'NextVolumeName(std::__1::basic_string , std::__1::allocator >&, bool)', 'Archive::~Archive()', 'Archive::ReadHeader()', 'std::__1::vector >::size[abi:ne180100]() const', 'std::__1::vector >::push_back[abi:ne180100](CmdExtract::ExtractRef const&)', 'CmdExtract::AnalyzeData::operator=(CmdExtract::AnalyzeData&&)', 'Wait()', 'CmdExtract::ExtractRef::~ExtractRef()', 'Archive::GetHeaderType()', 'File::Close()', 'std::__1::vector >::operator[][abi:ne180100](unsigned long)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'CmdExtract::GetFirstVolIfFullSet(std::__1::basic_string , std::__1::allocator > const&, bool, std::__1::basic_string , std::__1::allocator >&)']

8 5909 CmdExtract::AnalyzeArchive(std::__1::basic_string ,std::__1::allocator >const&,bool,bool) call site: 00000 /src/unrar/extract.cpp:1548
8 12 4 :

['Unpack::WrapUp(unsigned long)', 'FragmentedWindow::GetBlockSize(unsigned long, unsigned long)', 'Unpack::WrapDown(unsigned long)', 'FragmentedWindow::operator[](unsigned long)']

8 201 Unpack::UnpWriteArea(unsignedlong,unsignedlong) call site: 00000 /src/unrar/./unpack50.cpp:516
7 7 1 :

['mwcsicompc(wchar_t const*, wchar_t const*, bool)']

7 7 CmpName(wchar_tconst*,wchar_tconst*,unsignedint) call site: 00000 /src/unrar/match.cpp:77
6 6 5 :

['std::__1::basic_string , std::__1::allocator >::empty[abi:ne180100]() const', 'std::__1::basic_string , std::__1::allocator >::erase(unsigned long, unsigned long)', 'std::__1::basic_string , std::__1::allocator >::clear[abi:ne180100]()', 'wcsnicompc(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, unsigned long)', 'std::__1::basic_string , std::__1::allocator >::size[abi:ne180100]() const']

6 38 CmdExtract::ExtrPrepareName(Archive&,std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >&) call site: 00000 /src/unrar/extract.cpp:1216

Runtime coverage analysis

Covered functions
522
Functions that are reachable but not covered
383
Reachable functions
1435
Percentage of reachable functions covered
73.31%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/unrar/unrar_fuzzer.cc 1
/src/unrar/cmddata.cpp 12
/src/unrar/options.cpp 2
/src/unrar/./timefn.hpp 5
/src/unrar/./threadmisc.cpp 9
/src/unrar/strlist.cpp 11
/src/unrar/secpassword.cpp 9
/src/unrar/strlist.hpp 1
/src/unrar/./largepage.hpp 3
/src/unrar/largepage.cpp 8
/src/unrar/unicode.cpp 21
/src/unrar/strfn.cpp 12
/src/unrar/./consio.hpp 2
/src/unrar/errhnd.cpp 18
/src/unrar/./uisilent.cpp 10
/src/unrar/./pathfn.hpp 1
/src/unrar/pathfn.cpp 31
/src/unrar/./ui.hpp 38
/src/unrar/./secpassword.hpp 3
/src/unrar/consio.cpp 5
/src/unrar/archive.cpp 9
/src/unrar/./rawint.hpp 9
/src/unrar/filestr.cpp 2
/src/unrar/filefn.cpp 14
/src/unrar/find.cpp 5
/src/unrar/./find.hpp 2
/src/unrar/./match.hpp 1
/src/unrar/match.cpp 6
/src/unrar/file.cpp 22
/src/unrar/timefn.cpp 13
/src/unrar/system.cpp 3
/src/unrar/./file.hpp 5
/src/unrar/./cmdfilter.cpp 7
/src/unrar/./cmdmix.cpp 1
/src/unrar/./strlist.hpp 1
/src/unrar/extract.cpp 17
/src/unrar/./extract.hpp 4
/src/unrar/rdwrfn.cpp 13
/src/unrar/hash.cpp 14
/src/unrar/crypt.cpp 3
/src/unrar/./crypt.hpp 12
/src/unrar/rijndael.cpp 11
/src/unrar/threadpool.cpp 8
/src/unrar/unpack.cpp 7
/src/unrar/getbits.cpp 5
/src/unrar/./unpack50frag.cpp 8
/src/unrar/./model.cpp 18
/src/unrar/./suballoc.cpp 17
/src/unrar/rarvm.cpp 10
/src/unrar/./unpack50.cpp 13
/src/unrar/./getbits.hpp 6
/src/unrar/./unpack20.cpp 7
/src/unrar/./unpack30.cpp 12
/src/unrar/./unpack15.cpp 10
/src/unrar/./model.hpp 4
/src/unrar/./suballoc.hpp 4
/src/unrar/./unpack.hpp 9
/src/unrar/./rdwrfn.hpp 7
/src/unrar/qopen.cpp 7
/src/unrar/./headers.hpp 11
/src/unrar/headers.cpp 2
/src/unrar/./archive.hpp 3
/src/unrar/arcread.cpp 17
/src/unrar/rawread.cpp 14
/src/unrar/./crypt1.cpp 5
/src/unrar/./crypt2.cpp 5
/src/unrar/./rawread.hpp 6
/src/unrar/crc.cpp 3
/src/unrar/./crypt3.cpp 1
/src/unrar/sha1.cpp 5
/src/unrar/./crypt5.cpp 4
/src/unrar/sha256.cpp 5
/src/unrar/encname.cpp 2
/src/unrar/./qopen.hpp 1
/src/unrar/cmddata.hpp 1
/src/unrar/./unicode.hpp 1
/src/unrar/./arccmt.cpp 4
/usr/local/bin/../include/c++/v1/new 1
/usr/local/bin/../include/c++/v1/__exception/exception.h 1
/src/unrar/./blake2s.hpp 7
/src/unrar/./blake2sp.cpp 5
/src/unrar/blake2s.cpp 7
/src/unrar/./blake2s_sse.cpp 2
/src/unrar/smallfn.cpp 2
/src/unrar/./unpackinline.cpp 4
/src/unrar/./coder.cpp 5
/src/unrar/./rarvm.hpp 1
/src/unrar/./unpack50mt.cpp 6
/src/unrar/extinfo.cpp 7
/src/unrar/./uowners.cpp 2
/src/unrar/filcreat.cpp 1
/src/unrar/./uicommon.cpp 1
/src/unrar/./hardlinks.cpp 1
/src/unrar/./ulinks.cpp 4
/src/unrar/./errhnd.hpp 2

Analyses and suggestions

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
Archive::RequestArcPassword(RarCheckPassword*) 31 14 45.16% ['unrar_fuzzer']
CommandData::ParseArg(wchar_tconst*) 63 15 23.80% ['unrar_fuzzer']
CommandData::ProcessSwitch(wchar_tconst*) 681 13 1.908% ['unrar_fuzzer']
CommandData::CheckArgs(StringList*,bool,std::__1::basic_string ,std::__1::allocator >const&,bool,int) 52 7 13.46% ['unrar_fuzzer']
CommandData::TimeCheck(RarTime&,RarTime&,RarTime&) 58 10 17.24% ['unrar_fuzzer']
CryptData::SetCryptKeys(bool,CRYPT_METHOD,SecPassword*,unsignedcharconst*,unsignedcharconst*,unsignedint,unsignedchar*,unsignedchar*) 35 3 8.571% ['unrar_fuzzer']
CmdExtract::ExtrPrepareName(Archive&,std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >&) 77 20 25.97% ['unrar_fuzzer']
CmdExtract::AnalyzeArchive(std::__1::basic_string ,std::__1::allocator >const&,bool,bool) 113 6 5.309% ['unrar_fuzzer']
File::Write(voidconst*,unsignedlong) 35 18 51.42% ['unrar_fuzzer']
File::RawSeek(long,int) 40 11 27.50% ['unrar_fuzzer']
match(wchar_tconst*,wchar_tconst*,bool) 46 13 28.26% ['unrar_fuzzer']
NextVolumeName(std::__1::basic_string ,std::__1::allocator >&,bool) 46 17 36.95% ['unrar_fuzzer']
VolNameToFirstName(std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >&,bool) 44 17 38.63% ['unrar_fuzzer']
QuickOpen::Read(void*,unsignedlong,unsignedlong&) 37 3 8.108% []
RawRead::Read(unsignedlong) 32 14 43.75% ['unrar_fuzzer']
ComprDataIO::UnpWrite(unsignedchar*,unsignedlong) 36 17 47.22% ['unrar_fuzzer']
uiAskReplaceEx(CommandData*,std::__1::basic_string ,std::__1::allocator >&,long,RarTime*,unsignedint) 35 17 48.57% ['unrar_fuzzer']

Files and Directories in report

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file Reached by Covered by
[] []
/src/unrar/./threadmisc.cpp ['unrar_fuzzer'] []
/src/unrar/threadpool.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./headers.hpp ['unrar_fuzzer'] []
/src/unrar/rawread.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./getbits.hpp ['unrar_fuzzer'] []
/src/unrar/sha1.cpp ['unrar_fuzzer'] []
/src/unrar/filefn.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./rawint.hpp ['unrar_fuzzer'] []
/src/unrar/strlist.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./uowners.cpp ['unrar_fuzzer'] []
/src/unrar/./consio.hpp ['unrar_fuzzer'] []
/src/unrar/arcread.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./archive.hpp ['unrar_fuzzer'] []
/src/unrar/crc.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/match.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/rdwrfn.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./uicommon.cpp ['unrar_fuzzer'] []
/src/unrar/./secpassword.hpp ['unrar_fuzzer'] []
/src/unrar/./log.cpp [] []
/src/unrar/filcreat.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/pathfn.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./uisilent.cpp ['unrar_fuzzer'] []
/src/unrar/./find.hpp ['unrar_fuzzer'] []
/src/unrar/extinfo.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./model.cpp ['unrar_fuzzer'] []
/src/unrar/extract.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/usr/local/bin/../include/c++/v1/stdexcept [] []
/usr/local/bin/../include/c++/v1/new ['unrar_fuzzer'] []
/src/unrar/./blake2sp.cpp ['unrar_fuzzer'] []
/src/unrar/cmddata.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/hash.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/cmddata.hpp ['unrar_fuzzer'] []
/src/unrar/largepage.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/rarvm.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/unpack.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./errhnd.hpp ['unrar_fuzzer'] []
/src/unrar/./rarvm.hpp ['unrar_fuzzer'] []
/src/unrar/encname.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./win32stm.cpp [] []
/src/unrar/./strlist.hpp ['unrar_fuzzer'] []
/src/unrar/./crypt.hpp ['unrar_fuzzer'] []
/src/unrar/./arccmt.cpp ['unrar_fuzzer'] []
/src/unrar/./unpack50frag.cpp ['unrar_fuzzer'] []
/src/unrar/./crypt3.cpp ['unrar_fuzzer'] []
/src/unrar/./unpack.hpp ['unrar_fuzzer'] []
/src/unrar/./qopen.hpp ['unrar_fuzzer'] []
/src/unrar/scantree.cpp [] []
/src/unrar/./extract.hpp ['unrar_fuzzer'] []
/src/unrar/./unpack50.cpp ['unrar_fuzzer'] []
/src/unrar/./unpack30.cpp ['unrar_fuzzer'] []
/src/unrar/./ui.hpp ['unrar_fuzzer'] []
/src/unrar/./match.hpp ['unrar_fuzzer'] []
/src/unrar/system.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./unicode.hpp ['unrar_fuzzer'] []
/src/unrar/./blake2s.hpp ['unrar_fuzzer'] []
/src/unrar/./model.hpp ['unrar_fuzzer'] []
/src/unrar/./rawread.hpp ['unrar_fuzzer'] []
/src/unrar/./crypt2.cpp ['unrar_fuzzer'] []
/src/unrar/./timefn.hpp ['unrar_fuzzer'] []
/src/unrar/filestr.cpp ['unrar_fuzzer'] []
/src/unrar/./cmdfilter.cpp ['unrar_fuzzer'] []
/src/unrar/getbits.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/unicode.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/qopen.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/options.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./unpack20.cpp ['unrar_fuzzer'] []
/src/unrar/./rdwrfn.hpp ['unrar_fuzzer'] []
/src/unrar/file.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./unpack15.cpp ['unrar_fuzzer'] []
/usr/local/bin/../include/c++/v1/__exception/exception.h ['unrar_fuzzer'] []
/src/unrar/global.cpp [] []
/src/unrar/./hardlinks.cpp ['unrar_fuzzer'] []
/src/unrar/./pathfn.hpp ['unrar_fuzzer'] []
/src/unrar/./crypt5.cpp ['unrar_fuzzer'] []
/usr/local/bin/../include/c++/v1/string [] []
/src/unrar/./unpack50mt.cpp ['unrar_fuzzer'] []
/src/unrar/./cmdmix.cpp ['unrar_fuzzer'] []
/src/unrar/secpassword.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./suballoc.cpp ['unrar_fuzzer'] []
/src/unrar/./file.hpp ['unrar_fuzzer'] []
/src/unrar/./blake2s_sse.cpp ['unrar_fuzzer'] []
/src/unrar/crypt.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/blake2s.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/unrar_fuzzer.cc ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/rijndael.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/strfn.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/errhnd.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/smallfn.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/archive.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./unpackinline.cpp ['unrar_fuzzer'] []
/src/unrar/strlist.hpp ['unrar_fuzzer'] []
/src/unrar/find.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./largepage.hpp ['unrar_fuzzer'] []
/src/unrar/headers.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./suballoc.hpp ['unrar_fuzzer'] []
/src/unrar/./crypt1.cpp ['unrar_fuzzer'] []
/src/unrar/sha256.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/consio.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/timefn.cpp ['unrar_fuzzer'] ['unrar_fuzzer']
/src/unrar/./ulinks.cpp ['unrar_fuzzer'] []
/src/unrar/./coder.cpp ['unrar_fuzzer'] []

Directories in report

Directory
/usr/local/bin/../include/c++/v1/__exception/
/src/unrar/./
/src/unrar/
/usr/local/bin/../include/c++/v1/