High level conclusions

Fuzzer test_blkid_fuzz is blocked:

The runtime code coverage of test_blkid_fuzz covers 26.02% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer test_last_fuzz is blocked:

The runtime code coverage of test_last_fuzz covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 26.34% of cyclomatic complexity.

Fuzzers reach 23.15% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

551 / 2380

Cyclomatic complexity statically reachable by fuzzers

4305 / 16340

Runtime code coverage of functions

784 / 2380

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: test_last_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	168	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	168	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
167	0	EP	call site: 00000	process_wtmp_file

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

69

Reachable functions

69

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
login-utils/last.c	8
lib/fileutils.c	1
./include/all-io.h	1
./include/vfs.h	1
./include/c.h	1
./include/strutils.h	2
lib/timeutils.c	3
./include/carefulputc.h	1
./include/cctype.h	1
./include/xalloc.h	2

Fuzzer: test_smartcols_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	172	57.5%
gold	[1:9]	3	1.00%
yellow	[10:29]	4	1.33%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	120	40.1%
All colors	299	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
65	222	scols_filter_parse_string	call site: 00222	filter_dump_node
26	126	__filter_new_node	call site: 00126	filter_unref_node
12	90	ul_parse_size	call site: 00090	yyerror
8	162	filter_compile_param	call site: 00162	filter_new_param
7	21	filter_free_param	call site: 00021	ul_debug_prefix
6	49	yyensure_buffer_stack	call site: 00049	yy_fatal_error
5	80	ul_parse_size	call site: 00080	__ctype_b_loc
5	189	list_add_tail	call site: 00189	filter_new_param
4	68	yylex	call site: 00068	strtosize
3	4	scols_new_filter	call site: 00004	getpid
3	103	yylex	call site: 00103	yy_fatal_error
3	113	yy_get_next_buffer	call site: 00113	yy_create_buffer

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

63

Reachable functions

116

Percentage of reachable functions covered

45.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsmartcols/src/fuzz.c	2
libsmartcols/src/filter.c	9
lib/debug.c	2
libsmartcols/src/filter-expr.c	4
libsmartcols/src/filter-param.c	10
./include/list.h	6
libsmartcols/src/column.c	1
libsmartcols/src/cell.c	1
lib/buffer.c	1
libsmartcols/src/filter-scanner.c	21
libsmartcols/src/filter-parser.c	4
lib/strutils.c	3
libsmartcols/src/filter-parser.y	1
./include/strutils.h	2
lib/jsonwrt.c	10
./include/cctype.h	2

Fuzzer: test_fdisk_script_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	173	26.7%
gold	[1:9]	5	0.77%
yellow	[10:29]	1	0.15%
greenyellow	[30:49]	2	0.30%
lawngreen	50+	465	71.9%
All colors	646	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
66	420	fdisk_script_write_file	call site: 00420	write_file_json
39	111	ul_strtou64	call site: 00111	fdisk_warnx
18	529	fdisk_parttype_get_code	call site: 00529	ul_jsonwrt_value_s
12	511	fdisk_partname	call site: 00511	ul_jsonwrt_value_s
6	491	ul_canonicalize_dm_name_prefixed	call site: 00491	fgets
4	524	fdisk_parttype_get_string	call site: 00524	ul_jsonwrt_value_s
3	9	__write_all	call site: 00009	xusleep
3	17	fdisk_new_context	call site: 00017	getpid
3	155	script_get_header	call site: 00155	fdisk_script_free_header
3	622	fdisk_deinit_label	call site: 00622	ul_debug_prefix
3	638	fdisk_free_wipe_areas	call site: 00638	ul_debug_prefix
2	21	fdisk_new_context	call site: 00021	vfprintf

Runtime coverage analysis

Covered functions

110

Functions that are reachable but not covered

73

Reachable functions

179

Percentage of reachable functions covered

59.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfdisk/src/script.c	29
lib/fileutils.c	1
./include/all-io.h	1
./include/vfs.h	1
./include/c.h	1
libfdisk/src/context.c	6
lib/debug.c	2
libfdisk/src/gpt.c	1
libfdisk/src/dos.c	1
libfdisk/src/bsd.c	1
libfdisk/src/sgi.c	1
libfdisk/src/sun.c	1
./include/strutils.h	5
libfdisk/src/table.c	8
./include/list.h	5
./include/cctype.h	4
lib/strutils.c	4
libfdisk/src/ask.c	11
libfdisk/src/partition.c	22
./include/mangle.h	1
lib/mangle.c	1
libfdisk/src/parttype.c	15
lib/jsonwrt.c	10
libfdisk/src/iter.c	1
libfdisk/src/utils.c	1
lib/canonicalize.c	2
libfdisk/src/label.c	2
./include/carefulputc.h	1
libfdisk/src/alignment.c	1
libfdisk/src/wipe.c	1

Fuzzer: test_blkid_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	311	77.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	88	22.0%
All colors	399	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
98	230	blkid_probe_is_wholedisk	call site: 00230	blkid_probe_get_wholedisk_devno
88	16	blkid_probe_open_device	call site: 00016	sysfs_devno_is_dm_hidden
59	170	blkid_probe_set_device	call site: 00170	blkid_probe_is_wholedisk
19	340	get_hint	call site: 00340	blkid_probe_set_hint
9	329	ul_vfs_lseek	call site: 00329	blkid_probe_get_hint
8	111	ul_vfs_close	call site: 00111	ul_unref_path
5	105	ul_vfs_read	call site: 00105	ul_vfs_close
5	373	blkid_probe_set_device	call site: 00373	blkid_free_probe
4	161	blkid_probe_reset_hints	call site: 00161	ul_debug_prefix
4	360	list_add_tail	call site: 00360	ul_debug_prefix
3	8	blkid_new_probe	call site: 00008	getpid
3	365	blkid_probe_set_device	call site: 00365	blkid_get_io_size

Runtime coverage analysis

Covered functions

278

Functions that are reachable but not covered

108

Reachable functions

146

Percentage of reachable functions covered

26.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libblkid/src/fuzz.c	2
libblkid/src/probe.c	27
lib/debug.c	2
lib/sysfs.c	16
lib/path.c	20
./include/all-io.h	1
./include/vfs.h	4
./include/c.h	2
./include/list.h	5
lib/blkdev.c	3
./include/sysfs.h	2
lib/fileutils.c	3
libblkid/src/devno.c	1
./include/cctype.h	2
./include/fileutils.h	1
./include/strutils.h	2
libblkid/src/tag.c	1
libblkid/src/partitions/partitions.c	2
libblkid/src/superblocks/superblocks.c	2

Fuzzer: test_mount_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	618	40.8%
gold	[1:9]	224	14.7%
yellow	[10:29]	63	4.16%
greenyellow	[30:49]	126	8.32%
lawngreen	50+	483	31.9%
All colors	1514	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
39	282	mnt_parse_mountinfo_line	call site: 00282	sync_opts_from_optlist
29	907	blkdev_get_size	call site: 00907	sysfs_chrdev_devno_to_devname
26	640	blkid_read_config	call site: 00640	parse_next
23	1233	lvm_probe_all	call site: 01233	probe_one
17	368	next_u64	call site: 00368	__mnt_fs_set_source_ptr
17	1258	probe_one	call site: 01258	blkid__scan_dir
16	1054	get_hint	call site: 01054	blkid_probe_set_hint
14	1418	blkid_flush_cache	call site: 01418	ul_debug_prefix
13	343	fs_strdup_options	call site: 00343	mnt_optstr_append_option
12	459	is_dm_devname	call site: 00459	ul_canonicalize_dm_name
11	133	mnt_parse_table_line	call site: 00133	mnt_optlist_set_optstr
10	674	evaluate_by_udev	call site: 00674	ul_debug_prefix

Runtime coverage analysis

Covered functions

379

Functions that are reachable but not covered

162

Reachable functions

399

Percentage of reachable functions covered

59.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libmount/src/fuzz.c	1
libmount/src/tab.c	12
lib/debug.c	2
./include/c.h	4
libmount/src/tab_parse.c	19
libmount/src/fs.c	22
./include/strutils.h	5
lib/strutils.c	5
lib/mangle.c	3
libblkid/src/tag.c	10
libmount/src/utils.c	6
libmount/src/optlist.c	16
./include/list.h	7
libmount/src/optmap.c	2
libmount/src/optstr.c	8
lib/buffer.c	7
lib/mbsalign.c	2
libmount/src/mountP.h	1
libmount/src/iter.c	1
libmount/src/fs_statmount.c	3
libmount/src/cache.c	10
lib/canonicalize.c	5
lib/sysfs.c	20
lib/path.c	26
./include/sysfs.h	2
libblkid/src/evaluate.c	5
libblkid/src/config.c	4
lib/env.c	1
./include/cctype.h	3
libblkid/src/encode.c	7
./include/closestream.h	1
libblkid/src/cache.c	4
libblkid/src/read.c	10
libblkid/src/devname.c	10
libblkid/src/dev.c	2
libblkid/src/verify.c	2
./include/all-io.h	1
./include/vfs.h	6
libblkid/src/probe.c	31
lib/blkdev.c	3
lib/fileutils.c	4
libblkid/src/devno.c	7
./include/fileutils.h	1
libblkid/src/superblocks/superblocks.c	3
libblkid/src/partitions/partitions.c	2
libblkid/src/resolve.c	1
libblkid/src/save.c	3
libmount/src/tab_listmount.c	1

Fuzzer: test_fdisk_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	393	54.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.13%
greenyellow	[30:49]	5	0.69%
lawngreen	50+	317	44.2%
All colors	716	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
136	206	ul_vfs_read	call site: 00206	blkid_probe_is_wholedisk
96	343	blkid_probe_is_wholedisk	call site: 00343	blkid_probe_get_wholedisk_devno
19	451	get_hint	call site: 00451	blkid_probe_set_hint
12	42	fdisk_is_listonly	call site: 00042	fdisk_assign_fd
11	193	blkid_probe_set_device	call site: 00193	blkdev_get_size
11	698	fdisk_ask_get_type	call site: 00698	fdisk_warn
9	440	ul_vfs_lseek	call site: 00440	blkid_probe_get_hint
8	56	fdisk_get_label	call site: 00056	c_strcasecmp
8	490	blkid_probe_get_binary_data	call site: 00490	ul_debug_prefix
6	111	fdisk_unref_partition	call site: 00111	fdisk_unref_context
5	31	fdisk_assign_device	call site: 00031	ul_debug_prefix
5	89	reset_context	call site: 00089	fdisk_reset_script

Runtime coverage analysis

Covered functions

408

Functions that are reachable but not covered

134

Reachable functions

241

Percentage of reachable functions covered

44.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfdisk/src/fuzz.c	2
libfdisk/src/context.c	15
lib/debug.c	2
libfdisk/src/gpt.c	1
libfdisk/src/dos.c	1
libfdisk/src/bsd.c	1
libfdisk/src/sgi.c	1
libfdisk/src/sun.c	1
libfdisk/src/script.c	4
./include/strutils.h	3
libfdisk/src/label.c	2
./include/cctype.h	3
libfdisk/src/alignment.c	11
libfdisk/src/table.c	9
./include/list.h	5
libfdisk/src/partition.c	16
libfdisk/src/parttype.c	1
libfdisk/src/wipe.c	2
libblkid/src/probe.c	29
./include/vfs.h	3
lib/blkdev.c	6
./include/all-io.h	1
./include/c.h	2
lib/sysfs.c	15
lib/path.c	20
./include/sysfs.h	2
lib/fileutils.c	3
libblkid/src/devno.c	1
./include/fileutils.h	1
libblkid/src/tag.c	1
libblkid/src/topology/topology.c	5
libfdisk/src/utils.c	3
libblkid/src/superblocks/superblocks.c	2
libblkid/src/partitions/partitions.c	2
libfdisk/src/iter.c	1
libfdisk/src/ask.c	12

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
probe_dos_pt	/src/util-linux/libblkid/src/partitions/dos.c	2	['N/A', 'N/A']	9	0	650	127	43	138	0	734	584
mnt_table_is_fs_mounted	/src/util-linux/libmount/src/tab.c	2	['N/A', 'N/A']	25	0	18	3	2	381	0	2562	550
dos_add_partition	/src/util-linux/libfdisk/src/dos.c	3	['N/A', 'N/A', 'N/A']	10	0	1377	279	91	110	0	634	484
fdisk_set_partition	/src/util-linux/libfdisk/src/partition.c	3	['N/A', 'size_t', 'N/A']	9	0	305	53	20	87	0	549	317
scols_copy_table	/src/util-linux/libsmartcols/src/table.c	1	['N/A']	9	0	205	42	16	82	0	358	289
gpt_add_partition	/src/util-linux/libfdisk/src/gpt.c	3	['N/A', 'N/A', 'N/A']	9	0	1243	217	66	133	0	643	276
scols_line_apply_filter	/src/util-linux/libsmartcols/src/filter.c	3	['N/A', 'N/A', 'N/A']	7	0	179	38	13	79	0	362	203

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

915 / 2380

Cyclomatic complexity statically reachable by fuzzers

6976 / 16340

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

login-utils/last.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

libsmartcols/src/fuzz.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['scols_filter_parse_string', '__filter_new_node', 'ul_parse_size', 'filter_compile_param', 'filter_free_param', 'yyensure_buffer_stack', 'list_add_tail', 'yylex', 'scols_new_filter']

libfdisk/src/script.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fdisk_script_write_file', 'ul_strtou64', 'fdisk_parttype_get_code', 'fdisk_partname', 'ul_canonicalize_dm_name_prefixed', 'fdisk_parttype_get_string', '__write_all', 'fdisk_new_context', 'script_get_header', 'fdisk_deinit_label']

libblkid/src/fuzz.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['blkid_probe_is_wholedisk', 'blkid_probe_open_device', 'blkid_probe_set_device', 'get_hint', 'ul_vfs_lseek', 'ul_vfs_close', 'ul_vfs_read', 'blkid_probe_reset_hints', 'list_add_tail']

libmount/src/fuzz.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['mnt_parse_mountinfo_line', 'blkdev_get_size', 'blkid_read_config', 'lvm_probe_all', 'next_u64', 'probe_one', 'get_hint', 'blkid_flush_cache', 'fs_strdup_options', 'is_dm_devname']

libfdisk/src/fuzz.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ul_vfs_read', 'blkid_probe_is_wholedisk', 'get_hint', 'fdisk_is_listonly', 'blkid_probe_set_device', 'fdisk_ask_get_type', 'ul_vfs_lseek', 'fdisk_get_label', 'blkid_probe_get_binary_data', 'fdisk_unref_partition']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
yytnamerr	34	7	20.58%	['test_smartcols_fuzz']
yy_get_next_buffer	90	48	53.33%	['test_smartcols_fuzz']
probe_atari_pt	80	40	50.0%	['test_fdisk_fuzz', 'test_mount_fuzz', 'test_blkid_fuzz']
probe_bsd_pt	95	13	13.68%	['test_fdisk_fuzz', 'test_blkid_fuzz']
probe_dos_pt	114	45	39.47%	['test_fdisk_fuzz', 'test_mount_fuzz', 'test_blkid_fuzz']
probe_mac_pt	76	27	35.52%	['test_fdisk_fuzz', 'test_blkid_fuzz']
probe_minix_pt	51	14	27.45%	['test_fdisk_fuzz', 'test_mount_fuzz', 'test_blkid_fuzz']
probe_sgi_pt	44	20	45.45%	['test_fdisk_fuzz', 'test_blkid_fuzz']
probe_solaris_pt	57	23	40.35%	['test_fdisk_fuzz', 'test_blkid_fuzz']
probe_sun_pt	64	22	34.37%	['test_fdisk_fuzz', 'test_blkid_fuzz']
probe_ultrix_pt	42	21	50.0%	['test_fdisk_fuzz', 'test_mount_fuzz', 'test_blkid_fuzz']
read_buffer	40	21	52.5%	['test_fdisk_fuzz', 'test_mount_fuzz', 'test_blkid_fuzz']
blkdev_get_size	37	4	10.81%	['test_fdisk_fuzz', 'test_mount_fuzz', 'test_blkid_fuzz']
blkid_get_dev	80	42	52.5%	['test_mount_fuzz']
lvm_probe_all	53	7	13.20%	['test_mount_fuzz']
probe_one	65	35	53.84%	['test_mount_fuzz']
blkid_encode_string	35	19	54.28%	['test_mount_fuzz']
evaluate_by_udev	38	17	44.73%	['test_mount_fuzz']
blkid_partlist_devno_to_partition	58	25	43.10%	['test_mount_fuzz']
blkid_flush_cache	108	53	49.07%	['test_mount_fuzz']
probe_ddf	40	17	42.5%	['test_mount_fuzz']
probe_raid0	61	18	29.50%	['test_mount_fuzz']
probe_pdcraid	31	8	25.80%	['test_mount_fuzz']
probe_zfs	37	18	48.64%	['test_mount_fuzz']
topology_probe	45	6	13.33%	['test_fdisk_fuzz']
fdisk_apply_user_device_properties	44	24	54.54%	['test_fdisk_fuzz']
fdisk_deassign_device	35	14	40.0%	['test_fdisk_fuzz']
gpt_probe_label	62	21	33.87%	['test_fdisk_fuzz']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/util-linux/lib/path.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/superblocks/nvidia_raid.c	[]	[]
/src/util-linux/libblkid/src/topology/dm.c	[]	[]
/src/util-linux/./include/carefulputc.h	['test_last_fuzz', 'test_fdisk_script_fuzz']	[]
/src/util-linux/lib/buffer.c	['test_smartcols_fuzz', 'test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/lib/randutils.c	[]	[]
/src/util-linux/libblkid/src/superblocks/vdo.c	[]	[]
/src/util-linux/libblkid/src/superblocks/drbd.c	[]	[]
/src/util-linux/libblkid/src/superblocks/sysv.c	[]	[]
/src/util-linux/libblkid/src/superblocks/gfs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/reiserfs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/highpoint_raid.c	[]	[]
/src/util-linux/libblkid/src/partitions/ultrix.c	[]	[]
/src/util-linux/libfdisk/src/partition.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/vxfs.c	[]	[]
/src/util-linux/libmount/src/fs_statmount.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/./include/xalloc.h	['test_last_fuzz']	[]
/src/util-linux/lib/env.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/superblocks/minix.c	[]	[]
/src/util-linux/libmount/src/iter.c	['test_mount_fuzz']	[]
/src/util-linux/libblkid/src/superblocks/drbdproxy_datalog.c	[]	[]
/src/util-linux/libsmartcols/src/fuzz.c	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/libfdisk/src/fuzz.c	['test_fdisk_fuzz']	['test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/udf.c	[]	[]
/src/util-linux/libblkid/src/superblocks/superblocks.h	[]	[]
/src/util-linux/libmount/src/tab_listmount.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/superblocks/promise_raid.c	[]	[]
/src/util-linux/lib/timeutils.c	['test_last_fuzz']	[]
/src/util-linux/libblkid/src/devname.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/lib/crc32.c	[]	[]
/src/util-linux/libblkid/src/superblocks/befs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/netware.c	[]	[]
/src/util-linux/libblkid/src/topology/md.c	[]	[]
/src/util-linux/lib/md5.c	[]	[]
/src/util-linux/libmount/src/tab.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libuuid/src/unpack.c	[]	[]
/src/util-linux/lib/debug.c	['test_smartcols_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/libfdisk/src/wipe.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libsmartcols/src/filter-param.c	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/libuuid/src/gen_uuid.c	[]	[]
/src/util-linux/libfdisk/src/item.c	[]	[]
/src/util-linux/lib/match.c	[]	[]
/src/util-linux/libblkid/src/superblocks/adaptec_raid.c	[]	[]
/src/util-linux/./include/cctype.h	['test_last_fuzz', 'test_smartcols_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/libblkid/src/partitions/dasd.c	[]	[]
/src/util-linux/libfdisk/src/iter.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libfdisk/src/parttype.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/bluestore.c	[]	[]
/src/util-linux/libblkid/src/superblocks/apfs.c	[]	[]
/src/util-linux/libfdisk/src/ask.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/luks.c	[]	[]
/src/util-linux/libmount/src/utils.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/fuzz.c	['test_blkid_fuzz']	['test_blkid_fuzz']
/src/util-linux/libmount/src/btrfs.c	[]	[]
/src/util-linux/libblkid/src/topology/evms.c	[]	[]
/src/util-linux/libblkid/src/superblocks/exfat.c	[]	[]
/src/util-linux/libblkid/src/superblocks/erofs.c	[]	[]
/src/util-linux/libblkid/src/partitions/bsd.c	[]	[]
/src/util-linux/libblkid/src/superblocks/via_raid.c	[]	[]
/src/util-linux/libsmartcols/src/filter-parser.c	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/libblkid/src/superblocks/hpfs.c	[]	[]
/src/util-linux/libmount/src/tab_parse.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/superblocks/superblocks.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/xfs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/bcache.c	[]	[]
/src/util-linux/libblkid/src/superblocks/scoutfs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/isw_raid.c	[]	[]
/src/util-linux/libblkid/src/partitions/sun.c	[]	[]
/src/util-linux/libblkid/src/partitions/aix.c	[]	[]
/src/util-linux/./include/pt-mbr.h	[]	[]
/src/util-linux/libfdisk/src/utils.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/lib/canonicalize.c	['test_fdisk_script_fuzz', 'test_mount_fuzz']	['test_fdisk_script_fuzz', 'test_mount_fuzz']
/src/util-linux/libblkid/src/superblocks/drbdmanage.c	[]	[]
/src/util-linux/libblkid/src/partitions/atari.c	[]	[]
/src/util-linux/./include/list.h	['test_smartcols_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/libblkid/src/superblocks/ubifs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/btrfs.c	[]	[]
/src/util-linux/libblkid/src/config.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/lib/strv.c	[]	[]
/src/util-linux/./include/env.h	[]	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	[]	[]
/src/util-linux/libblkid/src/topology/ioctl.c	[]	[]
/src/util-linux/libblkid/src/superblocks/squashfs.c	[]	[]
/src/util-linux/lib/loopdev.c	[]	[]
/src/util-linux/libblkid/src/superblocks/lsi_raid.c	[]	[]
/src/util-linux/libblkid/src/superblocks/stratis.c	[]	[]
/src/util-linux/lib/sha256.c	[]	[]
/src/util-linux/libblkid/src/superblocks/cs_fvault2.c	[]	[]
/src/util-linux/libmount/src/mountP.h	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libsmartcols/src/table.c	[]	[]
/src/util-linux/libblkid/src/superblocks/vfat.c	[]	[]
/src/util-linux/libblkid/src/resolve.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/lib/crc32c.c	[]	[]
/src/util-linux/libblkid/src/superblocks/iso9660.c	[]	[]
/src/util-linux/libblkid/src/superblocks/linux_raid.c	[]	[]
/src/util-linux/./include/iso9660.h	[]	[]
/src/util-linux/libmount/src/optlist.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/superblocks/ufs.c	[]	[]
/src/util-linux/libblkid/src/topology/sysfs.c	[]	[]
/src/util-linux/libblkid/src/partitions/mac.c	[]	[]
/src/util-linux/lib/strutils.c	['test_smartcols_fuzz', 'test_fdisk_script_fuzz', 'test_mount_fuzz']	['test_smartcols_fuzz', 'test_fdisk_script_fuzz', 'test_mount_fuzz']
/src/util-linux/libfdisk/src/context.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/romfs.c	[]	[]
/src/util-linux/lib/crc64.c	[]	[]
/src/util-linux/lib/linux_version.c	[]	[]
/src/util-linux/libmount/src/optmap.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libmount/src/optstr.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libfdisk/src/sgi.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/mpool.c	[]	[]
/src/util-linux/libblkid/src/superblocks/swap.c	[]	[]
/src/util-linux/lib/sysfs.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/superblocks/ntfs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/vmfs.c	[]	[]
/src/util-linux/libblkid/src/evaluate.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libsmartcols/src/init.c	[]	[]
/src/util-linux/lib/jsonwrt.c	['test_smartcols_fuzz', 'test_fdisk_script_fuzz']	[]
/src/util-linux/libblkid/src/superblocks/hfs.c	[]	[]
/src/util-linux/libblkid/src/superblocks/zonefs.c	[]	[]
/src/util-linux/./include/c.h	['test_last_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/libfdisk/src/bsd.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/lib/mbsalign.c	['test_mount_fuzz']	[]
/src/util-linux/lib/cpuset.c	[]	[]
/src/util-linux/libsmartcols/src/line.c	[]	[]
/src/util-linux/libsmartcols/src/version.c	[]	[]
/src/util-linux/libblkid/src/superblocks/bitlocker.c	[]	[]
/src/util-linux/libblkid/src/save.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/partitions/dos.c	[]	[]
/src/util-linux/libfdisk/src/dos.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/superblocks/ext.c	[]	[]
/src/util-linux/libblkid/src/partitions/sgi.c	[]	[]
/src/util-linux/libblkid/src/superblocks/cramfs.c	[]	[]
/src/util-linux/./include/closestream.h	['test_mount_fuzz']	[]
/src/util-linux/lib/color-names.c	[]	[]
/src/util-linux/lib/fileutils.c	['test_last_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_mount_fuzz']
/src/util-linux/libfdisk/src/gpt.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libmount/src/init.c	[]	[]
/src/util-linux/libsmartcols/src/smartcolsP.h	[]	[]
/src/util-linux/libblkid/src/superblocks/jmicron_raid.c	[]	[]
/src/util-linux/libsmartcols/src/column.c	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/libsmartcols/src/cell.c	['test_smartcols_fuzz']	[]
/src/util-linux/libsmartcols/src/filter.c	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/libsmartcols/src/grouping.c	[]	[]
/src/util-linux/libblkid/src/encode.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/tag.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_mount_fuzz']
/src/util-linux/lib/encode.c	[]	[]
/src/util-linux/libblkid/src/superblocks/silicon_raid.c	[]	[]
/src/util-linux/./include/strutils.h	['test_last_fuzz', 'test_smartcols_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/./include/pt-sgi.h	[]	[]
/src/util-linux/libblkid/src/superblocks/f2fs.c	[]	[]
/src/util-linux/libfdisk/src/script.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/partitions/partitions.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']
/src/util-linux/./include/canonicalize.h	[]	[]
/src/util-linux/libblkid/src/read.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libmount/src/fuzz.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/./include/fileutils.h	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/./include/partx.h	[]	[]
/src/util-linux/./include/pt-sun.h	[]	[]
/src/util-linux/libblkid/src/topology/lvm.c	[]	[]
/src/util-linux/libblkid/src/superblocks/ubi.c	[]	[]
/src/util-linux/libblkid/src/devno.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_mount_fuzz']
/src/util-linux/libsmartcols/src/symbols.c	[]	[]
/src/util-linux/lib/sha1.c	[]	[]
/src/util-linux/libfdisk/src/alignment.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libblkid/src/partitions/unixware.c	[]	[]
/src/util-linux/libfdisk/src/init.c	[]	[]
/src/util-linux/libblkid/src/superblocks/exfs.c	[]	[]
/src/util-linux/libblkid/src/partitions/gpt.c	[]	[]
/src/util-linux/libblkid/src/init.c	[]	[]
/src/util-linux/libblkid/src/version.c	[]	[]
/src/util-linux/./include/sysfs.h	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/libblkid/src/superblocks/ocfs.c	[]	[]
/src/util-linux/./include/xxhash.h	[]	[]
/src/util-linux/libblkid/src/superblocks/nilfs.c	[]	[]
/src/util-linux/libblkid/src/probe.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libsmartcols/src/filter-expr.c	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/login-utils/last.c	['test_last_fuzz']	[]
/src/util-linux/lib/mangle.c	['test_fdisk_script_fuzz', 'test_mount_fuzz']	['test_fdisk_script_fuzz', 'test_mount_fuzz']
/src/util-linux/libblkid/src/topology/topology.c	['test_fdisk_fuzz']	['test_fdisk_fuzz']
/src/util-linux/./include/mangle.h	['test_fdisk_script_fuzz']	[]
/src/util-linux/libblkid/src/verify.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/dev.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libblkid/src/cache.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libmount/src/cache.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libmount/src/fs.c	['test_mount_fuzz']	['test_mount_fuzz']
/src/util-linux/libuuid/src/unparse.c	[]	[]
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/util-linux/lib/blkdev.c	['test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	['test_mount_fuzz']
/src/util-linux/libfdisk/src/sun.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/./include/all-io.h	['test_last_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/libblkid/src/partitions/minix.c	[]	[]
/src/util-linux/./include/vfs.h	['test_last_fuzz', 'test_fdisk_script_fuzz', 'test_blkid_fuzz', 'test_mount_fuzz', 'test_fdisk_fuzz']	[]
/src/util-linux/libblkid/src/superblocks/jfs.c	[]	[]
/src/util-linux/libsmartcols/src/filter-scanner.c	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/libblkid/src/superblocks/lvm.c	[]	[]
/src/util-linux/libblkid/src/superblocks/zfs.c	[]	[]
/src/util-linux/libfdisk/src/table.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libfdisk/src/version.c	[]	[]
/src/util-linux/libfdisk/src/label.c	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']	['test_fdisk_script_fuzz', 'test_fdisk_fuzz']
/src/util-linux/libuuid/src/pack.c	[]	[]
/src/util-linux/libmount/src/version.c	[]	[]
/src/util-linux/libblkid/src/superblocks/ddf_raid.c	[]	[]
/src/util-linux/libblkid/src/partitions/solaris_x86.c	[]	[]
/src/util-linux/lib/ttyutils.c	[]	[]
/src/util-linux/libsmartcols/src/filter-parser.y	['test_smartcols_fuzz']	['test_smartcols_fuzz']
/src/util-linux/libuuid/src/parse.c	[]	[]
/src/util-linux/libsmartcols/src/iter.c	[]	[]

Directories in report

Directory
/src/util-linux/libuuid/src/
/src/util-linux/libfdisk/src/
/src/util-linux/libsmartcols/src/
/src/util-linux/libblkid/src/
/src/util-linux/login-utils/
/src/util-linux/libmount/src/
/src/util-linux/./include/
/usr/include/x86_64-linux-gnu/bits/
/src/util-linux/libblkid/src/superblocks/
/src/util-linux/lib/
/src/util-linux/libblkid/src/topology/
/src/util-linux/libblkid/src/partitions/