High level conclusions

Fuzzers reach 78.78% code coverage.

Fuzzers reach 35.58% of cyclomatic complexity.

Fuzzers reach 31.36% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

504 / 1607

Cyclomatic complexity statically reachable by fuzzers

2169 / 6095

Runtime code coverage of functions

1266 / 1607

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: PerMessageDeflate

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	5	100.%
All colors	5	100

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

3

Reachable functions

10

Percentage of reachable functions covered

70.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/PerMessageDeflate.cpp	1
/src/uWebSockets/fuzzing/./../src/PerMessageDeflate.h	1
/src/uWebSockets/fuzzing/./helpers.h	1

Fuzzer: QueryParser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/QueryParser.cpp	1
/src/uWebSockets/fuzzing/./../src/QueryParser.h	1

Fuzzer: MultipartParser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	11.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	16	88.8%
All colors	18	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	uWS::ParameterParser::getToken()	call site: 00012	__ctype_b_loc

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

7

Reachable functions

24

Percentage of reachable functions covered

70.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/MultipartParser.cpp	1
/src/uWebSockets/fuzzing/./../src/Multipart.h	7
/src/uWebSockets/fuzzing/./../src/MessageParser.h	1
/usr/local/bin/../include/c++/v1/optional	2
/usr/include/ctype.h	1

Fuzzer: Extensions

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	9.09%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	10	90.9%
All colors	11	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	4 : View List ['std::__1::to_string(int)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::basic_string , std::__1::allocator >::operator+=(std::__1::basic_string , std::__1::allocator > const&)']	0	0	uWS::negotiateCompression(bool,int,int,std::__1::basic_string_view >)	call site: 00000	/src/uWebSockets/fuzzing/./../src/WebSocketExtensions.h:192
0	0	None	0	0	uWS::negotiateCompression(bool,int,int,std::__1::basic_string_view >)	call site: 00000	/src/uWebSockets/fuzzing/./../src/WebSocketExtensions.h:211

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

3

Reachable functions

10

Percentage of reachable functions covered

70.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/Extensions.cpp	1
/src/uWebSockets/fuzzing/./../src/WebSocketExtensions.h	3
/usr/include/ctype.h	1

Fuzzer: TopicTree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	9	100.%
All colors	9	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	3 : View List ['std::__1::basic_ostream >& std::__1::operator<< >(std::__1::basic_ostream >&, char const*)', 'std::__1::basic_ostream >::operator<<(std::__1::basic_ostream >& (*)(std::__1::basic_ostream >&))', 'std::terminate()']	0	0	uWS::TopicTree ,std::__1::allocator >,std::__1::basic_string_view >>::checkIteratingSubscriber(uWS::Subscriber*)	call site: 00000	/src/uWebSockets/fuzzing/./../src/TopicTree.h:106

Runtime coverage analysis

Covered functions

20

Functions that are reachable but not covered

7

Reachable functions

19

Percentage of reachable functions covered

63.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/TopicTree.cpp	1
/src/uWebSockets/fuzzing/./../src/TopicTree.h	6
/src/uWebSockets/fuzzing/./helpers.h	1

Fuzzer: WebSocket

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	20.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	4	80.0%
All colors	5	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
35	35	1 : View List ['uWS::WebSocketProtocol ::unmaskAll(char*, char*)']	35	83	uWS::WebSocketProtocol ::consumeContinuation(char*&,unsignedint&,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/./../src/WebSocketProtocol.h:432
0	2	1 : View List ['Impl::forceClose(uWS::WebSocketState *, void*, std::__1::basic_string_view >)']	0	2	booluWS::WebSocketProtocol ::consumeMessage<6u,unsignedchar>(unsignedchar,char*&,unsignedint&,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/./../src/WebSocketProtocol.h:353

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

5

Reachable functions

11

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/WebSocket.cpp	1
/src/uWebSockets/fuzzing/./../src/WebSocketProtocol.h	2
/src/uWebSockets/fuzzing/./helpers.h	1

Fuzzer: Http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	5	100.%
All colors	5	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['exit']	2	2	autoStaticData::StaticData()::{lambda(auto:1*)#1}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:30
2	2	1 : View List ['exit']	2	2	autoStaticData::StaticData()::{lambda(auto:1*)#2}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:42
0	0	None	4	4	uWS::ChunkIterator::operator*()	call site: 00000	/src/uWebSockets/fuzzing/./../src/ChunkedEncoding.h:218
0	0	None	0	10	autouWS::HttpRouter ::getNode(uWS::HttpRouter ::Node*,std::__1::basic_string ,std::__1::allocator >,bool)::{lambda(auto:1&,auto:2&)#1}::operator() ::Node,std::__1::default_delete ::Node>>const,std::__1::default_delete ::Node>>(std::__1::unique_ptr ::Node,std::__1::default_delete ::Node>>const&,std::__1::default_delete ::Node>&)const	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpRouter.h:97
0	0	None	0	0	uWS::HttpRouter ::add(std::__1::vector ,std::__1::allocator >,std::__1::allocator ,std::__1::allocator >>>,std::__1::basic_string ,std::__1::allocator >,ofats::any_invocable *)>&&,unsignedint)	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpRouter.h:298
0	0	None	0	0	uWS::HttpRouter ::findHandler(std::__1::basic_string ,std::__1::allocator >,std::__1::basic_string ,std::__1::allocator >,unsignedint)	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpRouter.h:215
0	0	None	0	0	autoStaticData::StaticData()::{lambda(auto:1*)#3}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:54
0	0	None	0	0	autoStaticData::StaticData()::{lambda(auto:1*)#4}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:66

Runtime coverage analysis

Covered functions

127

Functions that are reachable but not covered

7

Reachable functions

11

Percentage of reachable functions covered

36.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/Http.cpp	1
/src/uWebSockets/fuzzing/./../src/HttpParser.h	2
/src/uWebSockets/fuzzing/./helpers.h	1

Fuzzer: HttpWithProxy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	6	100.%
All colors	6	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['exit']	2	2	autoStaticData::StaticData()::{lambda(auto:1*)#1}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:30
2	2	1 : View List ['exit']	2	2	autoStaticData::StaticData()::{lambda(auto:1*)#2}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:42
0	0	None	4	4	uWS::ChunkIterator::operator*()	call site: 00000	/src/uWebSockets/fuzzing/./../src/ChunkedEncoding.h:218
0	0	None	0	10	autouWS::HttpRouter ::getNode(uWS::HttpRouter ::Node*,std::__1::basic_string ,std::__1::allocator >,bool)::{lambda(auto:1&,auto:2&)#1}::operator() ::Node,std::__1::default_delete ::Node>>const,std::__1::default_delete ::Node>>(std::__1::unique_ptr ::Node,std::__1::default_delete ::Node>>const&,std::__1::default_delete ::Node>&)const	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpRouter.h:97
0	0	None	0	0	uWS::HttpRouter ::add(std::__1::vector ,std::__1::allocator >,std::__1::allocator ,std::__1::allocator >>>,std::__1::basic_string ,std::__1::allocator >,ofats::any_invocable *)>&&,unsignedint)	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpRouter.h:298
0	0	None	0	0	uWS::HttpRouter ::findHandler(std::__1::basic_string ,std::__1::allocator >,std::__1::basic_string ,std::__1::allocator >,unsignedint)	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpRouter.h:215
0	0	None	0	0	autoStaticData::StaticData()::{lambda(auto:1*)#3}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:54
0	0	None	0	0	autoStaticData::StaticData()::{lambda(auto:1*)#4}::operator() >(uWS::HttpRouter *)	call site: 00000	/src/uWebSockets/fuzzing/Http.cpp:66

Runtime coverage analysis

Covered functions

130

Functions that are reachable but not covered

9

Reachable functions

13

Percentage of reachable functions covered

30.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/Http.cpp	1
/src/uWebSockets/fuzzing/./../src/HttpParser.h	2
/src/uWebSockets/fuzzing/./../src/ProxyParser.h	1
/src/uWebSockets/fuzzing/./helpers.h	1

Fuzzer: AsyncEpollHelloWorld

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	12.7%
gold	[1:9]	1	0.63%
yellow	[10:29]	1	0.63%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	135	85.9%
All colors	157	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
58	60	2 : View List ['us_socket_timeout', 'uWS::HttpResponseData ::callOnWritable(unsigned long)']	58	60	uWS::HttpContext ::init()::{lambda(us_socket_t*)#1}::operator()(us_socket_t*)const	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpContext.h:327
24	37	4 : View List ['us_internal_poll_set_type', 'us_poll_change', 'us_socket_timeout', 'us_socket_close_connecting']	24	43	us_internal_dispatch_ready_poll	call site: 00000	/src/uWebSockets/fuzzing/../uSockets/src/loop.c:214
2	4	2 : View List ['uWS::BackPressure::reserve(unsigned long)', 'uWS::BackPressure::length()']	2	6	uWS::AsyncSocket ::write(charconst*,int,bool,int)	call site: 00000	/src/uWebSockets/fuzzing/../src/AsyncSocket.h:312
2	2	1 : View List ['exit']	2	2	teardown()	call site: 00000	/src/uWebSockets/fuzzing/AsyncEpollHelloWorld.cpp:49
2	2	1 : View List ['__real_read']	2	2	__wrap_read	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:334
2	2	1 : View List ['__real_close']	2	2	__wrap_close	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:680
0	0	None	116	245	std::__1::pair uWS::HttpParser::fenceAndConsumePostPadded<0>(char*,unsignedint,void*,void*,uWS::HttpRequest*,ofats::any_invocable &,ofats::any_invocable >,bool)>&)	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpParser.h:434
0	0	None	116	245	std::__1::pair uWS::HttpParser::fenceAndConsumePostPadded<0>(char*,unsignedint,void*,void*,uWS::HttpRequest*,ofats::any_invocable &,ofats::any_invocable >,bool)>&)	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpParser.h:463
0	0	None	110	374	uWS::HttpParser::consumePostPadded(char*,unsignedint,void*,void*,ofats::any_invocable &&,ofats::any_invocable >,bool)>&&)	call site: 00000	/src/uWebSockets/fuzzing/./../src/HttpParser.h:533
0	0	1 : View List ['std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > >::operator=(std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)']	97	222	uWS::HttpContext ::onHttp(std::__1::basic_string ,std::__1::allocator >,std::__1::basic_string ,std::__1::allocator >,ofats::any_invocable *,uWS::HttpRequest*)>&&,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpContext.h:424
0	0	None	81	1119	uWS::HttpResponse ::internalEnd(std::__1::basic_string_view >,unsignedlong,bool,bool,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpResponse.h:97
0	0	None	51	174	uWS::HttpContext ::onHttp(std::__1::basic_string ,std::__1::allocator >,std::__1::basic_string ,std::__1::allocator >,ofats::any_invocable *,uWS::HttpRequest*)>&&,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpContext.h:433

Runtime coverage analysis

Covered functions

323

Functions that are reachable but not covered

53

Reachable functions

194

Percentage of reachable functions covered

72.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h	2
/src/uWebSockets/fuzzing/AsyncEpollHelloWorld.cpp	1
/src/uWebSockets/fuzzing/../src/App.h	6
/src/uWebSockets/fuzzing/../src/Loop.h	8
/src/uWebSockets/fuzzing/../uSockets/src/loop.c	5
/src/uWebSockets/fuzzing/../uSockets/src/eventing/epoll_kqueue.c	17
/src/uWebSockets/fuzzing/../src/LoopData.h	1
/src/uWebSockets/fuzzing/../src/MoveOnlyFunction.h	12
/src/uWebSockets/fuzzing/../src/HttpContext.h	8
/src/uWebSockets/fuzzing/../uSockets/src/context.c	12
/src/uWebSockets/fuzzing/../src/HttpContextData.h	2
/src/uWebSockets/fuzzing/../src/HttpRouter.h	11
/src/uWebSockets/fuzzing/../uSockets/src/bsd.c	4
/src/uWebSockets/fuzzing/../src/TopicTree.h	1

Fuzzer: EpollEchoServerPubSub

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	12.4%
gold	[1:9]	1	0.44%
yellow	[10:29]	1	0.44%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	195	86.6%
All colors	225	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
149	149	1 : View List ['bool uWS::TopicTree ::publishBig ::publish(std::__1::basic_string_view >, std::__1::basic_string_view >, uWS::OpCode, bool)::{lambda(uWS::Subscriber*, uWS::TopicTreeBigMessage&)#1}>(uWS::Subscriber*, std::__1::basic_string_view >, uWS::TopicTreeBigMessage&&, uWS::TemplatedApp ::publish(std::__1::basic_string_view >, std::__1::basic_string_view >, uWS::OpCode, bool)::{lambda(uWS::Subscriber*, uWS::TopicTreeBigMessage&)#1})']	149	149	uWS::TemplatedApp ::publish(std::__1::basic_string_view >,std::__1::basic_string_view >,uWS::OpCode,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/App.h:153
81	81	1 : View List ['uWS::HttpResponse ::writeUnsigned64(unsigned long)']	81	406	uWS::HttpResponse ::internalEnd(std::__1::basic_string_view >,unsignedlong,bool,bool,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpResponse.h:162
35	35	1 : View List ['uWS::WebSocketProtocol >::unmaskAll(char*, char*)']	35	346	uWS::WebSocketProtocol >::consumeContinuation(char*&,unsignedint&,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketProtocol.h:432
24	37	4 : View List ['us_internal_poll_set_type', 'us_poll_change', 'us_socket_timeout', 'us_socket_close_connecting']	24	43	us_internal_dispatch_ready_poll	call site: 00000	/src/uWebSockets/fuzzing/../uSockets/src/loop.c:214
4	12	2 : View List ['uWS::AsyncSocket ::getLoopData()', 'uWS::DeflationStream::deflate(uWS::ZlibContext*, std::__1::basic_string_view >, bool)']	4	215	uWS::WebSocket ::send(std::__1::basic_string_view >,uWS::OpCode,bool,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocket.h:136
4	10	9 : View List ['std::__1::optional > >::optional()', 'std::__1::basic_string_view >::data() const', 'uWS::InflationStream::inflate(uWS::ZlibContext*, std::__1::basic_string_view >, unsigned long, bool)', 'us_socket_context', 'us_socket_context_loop', 'std::__1::basic_string_view >::length() const', 'std::__1::__optional_storage_base >, false>::has_value() const', 'std::__1::optional > >::operator->()', 'us_loop_ext']	4	105	uWS::WebSocketContext ::handleFragment(char*,unsignedlong,unsignedint,int,bool,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketContext.h:71
4	10	10 : View List ['std::__1::optional > >::optional()', 'std::__1::basic_string_view >::data() const', 'uWS::InflationStream::inflate(uWS::ZlibContext*, std::__1::basic_string_view >, unsigned long, bool)', 'us_socket_context', 'us_socket_context_loop', 'std::__1::basic_string_view >::length() const', 'std::__1::__optional_storage_base >, false>::has_value() const', 'std::__1::optional > >::operator->()', 'us_loop_ext', 'std::__1::basic_string , std::__1::allocator >::append(char const*)']	4	105	uWS::WebSocketContext ::handleFragment(char*,unsignedlong,unsignedint,int,bool,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketContext.h:122
4	4	3 : View List ['std::__1::basic_string_view >::data() const', 'std::__1::basic_string_view >::length() const', 'ofats::any_invocable *, uWS::HttpRequest*, us_socket_context_t*)>::operator()(uWS::HttpResponse *, uWS::HttpRequest*, us_socket_context_t*)']	4	50	autouWS::TemplatedApp ::ws (std::__1::basic_string ,std::__1::allocator >,uWS::TemplatedApp ::WebSocketBehavior &&)::{lambda(auto:1*,auto:2*)#1}::operator() ,uWS::HttpRequest>(uWS::HttpResponse *,uWS::HttpRequest*)	call site: 00000	/src/uWebSockets/fuzzing/../src/App.h:407
2	4	2 : View List ['uWS::BackPressure::reserve(unsigned long)', 'uWS::BackPressure::length()']	2	6	uWS::AsyncSocket ::write(charconst*,int,bool,int)	call site: 00000	/src/uWebSockets/fuzzing/../src/AsyncSocket.h:312
2	2	1 : View List ['__real_read']	2	2	__wrap_read	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:334
2	2	1 : View List ['__real_close']	2	2	__wrap_close	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:680
0	79	2 : View List ['us_socket_timeout', 'uWS::AsyncSocket ::write(char const*, int, bool, int)']	0	79	autouWS::WebSocketContext ::init()::{lambda(auto:1*)#4}::operator() (us_socket_t*)const	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketContext.h:393

Runtime coverage analysis

Covered functions

688

Functions that are reachable but not covered

150

Reachable functions

552

Percentage of reachable functions covered

72.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h	2
/src/uWebSockets/fuzzing/EpollEchoServerPubSub.cpp	1
/src/uWebSockets/fuzzing/../src/App.h	8
/src/uWebSockets/fuzzing/../src/Loop.h	8
/src/uWebSockets/fuzzing/../uSockets/src/loop.c	5
/src/uWebSockets/fuzzing/../uSockets/src/eventing/epoll_kqueue.c	17
/src/uWebSockets/fuzzing/../src/LoopData.h	1
/src/uWebSockets/fuzzing/../src/MoveOnlyFunction.h	33
/src/uWebSockets/fuzzing/../src/HttpContext.h	8
/src/uWebSockets/fuzzing/../uSockets/src/context.c	15
/src/uWebSockets/fuzzing/../src/HttpContextData.h	2
/src/uWebSockets/fuzzing/../src/HttpRouter.h	11
/src/uWebSockets/fuzzing/../src/TopicTree.h	2
/src/uWebSockets/fuzzing/../src/WebSocketContext.h	9
/src/uWebSockets/fuzzing/../src/WebSocketContextData.h	2
/src/uWebSockets/fuzzing/../src/PerMessageDeflate.h	2
/src/uWebSockets/fuzzing/../uSockets/src/bsd.c	4

Fuzzer: EpollEchoServer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	25	10.6%
gold	[1:9]	1	0.42%
yellow	[10:29]	1	0.42%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	207	88.4%
All colors	234	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
169	169	1 : View List ['bool uWS::TopicTree ::publishBig ::publish(std::__1::basic_string_view >, std::__1::basic_string_view >, uWS::OpCode, bool)::{lambda(uWS::Subscriber*, uWS::TopicTreeBigMessage&)#1}>(uWS::Subscriber*, std::__1::basic_string_view >, uWS::TopicTreeBigMessage&&, uWS::WebSocket ::publish(std::__1::basic_string_view >, std::__1::basic_string_view >, uWS::OpCode, bool)::{lambda(uWS::Subscriber*, uWS::TopicTreeBigMessage&)#1})']	169	169	uWS::WebSocket ::publish(std::__1::basic_string_view >,std::__1::basic_string_view >,uWS::OpCode,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocket.h:362
81	81	1 : View List ['uWS::HttpResponse ::writeUnsigned64(unsigned long)']	81	406	uWS::HttpResponse ::internalEnd(std::__1::basic_string_view >,unsignedlong,bool,bool,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpResponse.h:162
38	42	3 : View List ['uWS::AsyncSocket ::uncorkWithoutSending()', 'us_socket_write2', 'uWS::BackPressure::append(char const*, unsigned long)']	38	59	uWS::WebSocket ::send(std::__1::basic_string_view >,uWS::OpCode,bool,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocket.h:110
38	42	3 : View List ['uWS::AsyncSocket ::uncorkWithoutSending()', 'us_socket_write2', 'uWS::BackPressure::append(char const*, unsigned long)']	38	59	uWS::WebSocket ::send(std::__1::basic_string_view >,uWS::OpCode,bool,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocket.h:110
35	35	1 : View List ['uWS::WebSocketProtocol >::unmaskAll(char*, char*)']	35	373	uWS::WebSocketProtocol >::consumeContinuation(char*&,unsignedint&,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketProtocol.h:432
24	37	4 : View List ['us_internal_poll_set_type', 'us_poll_change', 'us_socket_timeout', 'us_socket_close_connecting']	24	43	us_internal_dispatch_ready_poll	call site: 00000	/src/uWebSockets/fuzzing/../uSockets/src/loop.c:214
4	4	3 : View List ['std::__1::basic_string_view >::data() const', 'ofats::any_invocable *, uWS::HttpRequest*, us_socket_context_t*)>::operator()(uWS::HttpResponse *, uWS::HttpRequest*, us_socket_context_t*)', 'std::__1::basic_string_view >::length() const']	4	50	autouWS::TemplatedApp ::ws (std::__1::basic_string ,std::__1::allocator >,uWS::TemplatedApp ::WebSocketBehavior &&)::{lambda(auto:1*,auto:2*)#1}::operator() ,uWS::HttpRequest>(uWS::HttpResponse *,uWS::HttpRequest*)	call site: 00000	/src/uWebSockets/fuzzing/../src/App.h:407
2	4	2 : View List ['uWS::BackPressure::reserve(unsigned long)', 'uWS::BackPressure::length()']	2	6	uWS::AsyncSocket ::write(charconst*,int,bool,int)	call site: 00000	/src/uWebSockets/fuzzing/../src/AsyncSocket.h:312
2	2	2 : View List ['fwrite', 'free']	2	407	autotest()::$_7::operator() >(uWS::WebSocket *,std::__1::basic_string_view >,uWS::OpCode)const	call site: 00000	/src/uWebSockets/fuzzing/EpollEchoServer.cpp:96
2	2	1 : View List ['__real_read']	2	2	__wrap_read	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:334
2	2	1 : View List ['__real_close']	2	2	__wrap_close	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:680
0	29	1 : View List ['uWS::WebSocketContext ::forceClose(uWS::WebSocketState *, void*, std::__1::basic_string_view >)']	0	29	booluWS::WebSocketProtocol >::consumeMessage<6u,unsignedchar>(unsignedchar,char*&,unsignedint&,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketProtocol.h:353

Runtime coverage analysis

Covered functions

759

Functions that are reachable but not covered

149

Reachable functions

579

Percentage of reachable functions covered

74.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h	3
/src/uWebSockets/fuzzing/EpollEchoServer.cpp	1
/src/uWebSockets/fuzzing/../src/App.h	8
/src/uWebSockets/fuzzing/../src/Loop.h	8
/src/uWebSockets/fuzzing/../uSockets/src/loop.c	5
/src/uWebSockets/fuzzing/../uSockets/src/eventing/epoll_kqueue.c	17
/src/uWebSockets/fuzzing/../src/LoopData.h	1
/src/uWebSockets/fuzzing/../src/MoveOnlyFunction.h	39
/src/uWebSockets/fuzzing/../src/HttpContext.h	8
/src/uWebSockets/fuzzing/../uSockets/src/context.c	15
/src/uWebSockets/fuzzing/../src/HttpContextData.h	2
/src/uWebSockets/fuzzing/../src/HttpRouter.h	11
/src/uWebSockets/fuzzing/../src/TopicTree.h	2
/src/uWebSockets/fuzzing/../src/WebSocketContext.h	9
/src/uWebSockets/fuzzing/../src/WebSocketContextData.h	2
/src/uWebSockets/fuzzing/../src/PerMessageDeflate.h	2
/src/uWebSockets/fuzzing/../uSockets/src/bsd.c	4

Fuzzer: EpollHelloWorld

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	38	12.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.33%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	258	86.8%
All colors	297	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
58	60	2 : View List ['us_socket_timeout', 'uWS::HttpResponseData ::callOnWritable(unsigned long)']	58	60	uWS::HttpContext ::init()::{lambda(us_socket_t*)#1}::operator()(us_socket_t*)const	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpContext.h:327
38	42	3 : View List ['uWS::AsyncSocket ::uncorkWithoutSending()', 'us_socket_write2', 'uWS::BackPressure::append(char const*, unsigned long)']	38	59	uWS::WebSocket ::send(std::__1::basic_string_view >,uWS::OpCode,bool,bool)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocket.h:110
35	35	1 : View List ['uWS::WebSocketProtocol >::unmaskAll(char*, char*)']	35	373	uWS::WebSocketProtocol >::consumeContinuation(char*&,unsignedint&,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketProtocol.h:432
10	165	10 : View List ['uWS::AsyncSocket ::cork()', 'uWS::AsyncSocket ::corkedSocket()', 'std::__1::tuple_element<0ul, std::__1::pair >::type&& std::__1::get<0ul, int, bool>(std::__1::pair &&)', 'uWS::AsyncSocket ::uncork(char const*, int, bool)', 'uWS::AsyncSocket ::timeout(unsigned int)', 'uWS::HttpResponse ::getHttpResponseData()', 'uWS::AsyncSocket ::close()', 'std::__1::tuple_element<1ul, std::__1::pair >::type&& std::__1::get<1ul, int, bool>(std::__1::pair &&)', 'uWS::AsyncSocket ::shutdown()', 'uWS::AsyncSocket ::getBufferedAmount()']	10	169	uWS::HttpResponse ::cork(ofats::any_invocable &&)	call site: 00000	/src/uWebSockets/fuzzing/../src/HttpResponse.h:498
8	8	13 : View List ['std::__1::unordered_set , std::__1::equal_to , std::__1::allocator >::size() const', 'uWS::Subscriber::needsDrainage()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'operator delete(void*)', 'uWS::Subscriber::~Subscriber()', 'std::__1::set , std::__1::allocator >::end()', 'std::__1::__tree_const_iterator *, long>::operator*() const', 'std::__1::set , std::__1::allocator >::begin()', 'std::__1::operator!=(std::__1::__tree_const_iterator *, long> const&, std::__1::__tree_const_iterator *, long> const&)', 'std::__1::unordered_map >, std::__1::unique_ptr >, std::__1::hash > >, std::__1::equal_to > >, std::__1::allocator > const, std::__1::unique_ptr > > > >::erase(std::__1::basic_string_view > const&)', 'std::__1::unordered_set , std::__1::equal_to , std::__1::allocator >::erase(uWS::Subscriber* const&)', 'std::__1::__tree_const_iterator *, long>::operator++()', 'uWS::TopicTree ::unlinkDrainableSubscriber(uWS::Subscriber*)']	8	8	uWS::TopicTree ::freeSubscriber(uWS::Subscriber*)	call site: 00000	/src/uWebSockets/fuzzing/../src/TopicTree.h:225
4	4	3 : View List ['std::__1::basic_string_view >::data() const', 'ofats::any_invocable *, uWS::HttpRequest*, us_socket_context_t*)>::operator()(uWS::HttpResponse *, uWS::HttpRequest*, us_socket_context_t*)', 'std::__1::basic_string_view >::length() const']	4	50	autouWS::TemplatedApp ::ws (std::__1::basic_string ,std::__1::allocator >,uWS::TemplatedApp ::WebSocketBehavior &&)::{lambda(auto:1*,auto:2*)#1}::operator() ,uWS::HttpRequest>(uWS::HttpResponse *,uWS::HttpRequest*)	call site: 00000	/src/uWebSockets/fuzzing/../src/App.h:407
4	4	8 : View List ['std::__1::unordered_set , std::__1::equal_to , std::__1::allocator >::size() const', 'ofats::any_invocable *, std::__1::basic_string_view >, int, int)>::operator()(uWS::WebSocket *, std::__1::basic_string_view >, int, int)', 'std::__1::set , std::__1::allocator >::end()', 'std::__1::__tree_const_iterator *, long>::operator*() const', 'std::__1::set , std::__1::allocator >::begin()', 'std::__1::operator!=(std::__1::__tree_const_iterator *, long> const&, std::__1::__tree_const_iterator *, long> const&)', 'std::__1::__tree_const_iterator *, long>::operator++()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const']	4	37	autouWS::WebSocketContext ::init()::{lambda(auto:1*,int,void*)#1}::operator() (us_socket_t*,int,void*)const	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketContext.h:262
4	4	8 : View List ['std::__1::unordered_set , std::__1::equal_to , std::__1::allocator >::size() const', 'ofats::any_invocable *, std::__1::basic_string_view >, int, int)>::operator()(uWS::WebSocket *, std::__1::basic_string_view >, int, int)', 'std::__1::set , std::__1::allocator >::end()', 'std::__1::__tree_const_iterator *, long>::operator*() const', 'std::__1::set , std::__1::allocator >::begin()', 'std::__1::operator!=(std::__1::__tree_const_iterator *, long> const&, std::__1::__tree_const_iterator *, long> const&)', 'std::__1::__tree_const_iterator *, long>::operator++()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const']	4	26	uWS::WebSocket ::end(int,std::__1::basic_string_view >)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocket.h:223
2	4	2 : View List ['uWS::BackPressure::reserve(unsigned long)', 'uWS::BackPressure::length()']	2	6	uWS::AsyncSocket ::write(charconst*,int,bool,int)	call site: 00000	/src/uWebSockets/fuzzing/../src/AsyncSocket.h:312
2	2	1 : View List ['__real_read']	2	2	__wrap_read	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:334
2	2	1 : View List ['__real_close']	2	2	__wrap_close	call site: 00000	/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h:680
0	29	1 : View List ['uWS::WebSocketContext ::forceClose(uWS::WebSocketState *, void*, std::__1::basic_string_view >)']	0	29	booluWS::WebSocketProtocol >::consumeMessage<6u,unsignedchar>(unsignedchar,char*&,unsignedint&,uWS::WebSocketState *,void*)	call site: 00000	/src/uWebSockets/fuzzing/../src/WebSocketProtocol.h:353

Runtime coverage analysis

Covered functions

837

Functions that are reachable but not covered

168

Reachable functions

617

Percentage of reachable functions covered

72.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h	2
/src/uWebSockets/fuzzing/EpollHelloWorld.cpp	1
/src/uWebSockets/fuzzing/../src/App.h	17
/src/uWebSockets/fuzzing/../src/Loop.h	8
/src/uWebSockets/fuzzing/../uSockets/src/loop.c	6
/src/uWebSockets/fuzzing/../uSockets/src/eventing/epoll_kqueue.c	17
/src/uWebSockets/fuzzing/../src/LoopData.h	1
/src/uWebSockets/fuzzing/../src/MoveOnlyFunction.h	38
/src/uWebSockets/fuzzing/../src/HttpContext.h	8
/src/uWebSockets/fuzzing/../uSockets/src/context.c	22
/src/uWebSockets/fuzzing/../src/HttpContextData.h	2
/src/uWebSockets/fuzzing/../src/HttpRouter.h	12
/src/uWebSockets/fuzzing/../src/TopicTree.h	2
/src/uWebSockets/fuzzing/../src/WebSocketContext.h	9
/src/uWebSockets/fuzzing/../src/WebSocketContextData.h	2
/src/uWebSockets/fuzzing/../src/PerMessageDeflate.h	2
/src/uWebSockets/fuzzing/../uSockets/src/bsd.c	8
/src/uWebSockets/fuzzing/../uSockets/src/socket.c	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
autouWS::TemplatedApp ::ws (std::__1::basic_string ,std::__1::allocator >,uWS::TemplatedApp ::WebSocketBehavior &&)::{lambda(auto:1*,auto:2*)#1}::operator() ,uWS::HttpRequest>(uWS::HttpResponse *,uWS::HttpRequest*)	/src/uWebSockets/fuzzing/../src/App.h	3	['class.anon.207 *', 'struct.uWS::Loop *', 'struct.uWS::HttpRequest *']	10	0	171	16	4	540	0	734	551
uWS::HttpContext ::init()::{lambda(us_socket_t*,char*,int)#1}::__invoke(us_socket_t*,char*,int)	/src/uWebSockets/fuzzing/../src/HttpContext.h	3	['struct.us_socket_t *', 'char *', 'int ']	4	0	15	3	2	153	0	340	204
StaticData::StaticData()	/src/uWebSockets/fuzzing/Http.cpp	1	['struct.StaticData *']	2	0	292	60	41	38	2	180	176
uWS::Loop::run()	/src/uWebSockets/fuzzing/../src/Loop.h	1	['struct.uWS::Loop *']	4	0	14	3	2	50	0	161	92
uWS::WebSocketProtocol ::consume(char*,unsignedint,uWS::WebSocketState *,void*)	/src/uWebSockets/fuzzing/./../src/WebSocketProtocol.h	4	['char *', 'int ', 'struct.uWS::WebSocketState *', 'char *']	6	0	300	57	24	69	0	138	91
autotest()::$_1::operator() >(uWS::WebSocket *,std::__1::basic_string_view >,uWS::OpCode)const	/src/uWebSockets/fuzzing/EpollEchoServer.cpp	4	['struct.uWS::Loop *', 'char *', 'size_t ', 'char ']	5	0	97	18	8	133	0	309	79
uWS::HttpContext ::init()::{lambda(us_socket_t*,char*,int)#1}::operator()(us_socket_t*,char*,int)const::{lambda(void*,uWS::HttpRequest*)#1}::operator()({lambda(us_socket_t*,char*,int)#1},uWS::HttpRequest)const	/src/uWebSockets/fuzzing/../src/HttpContext.h	3	['class.anon.186 *', 'char *', 'struct.uWS::HttpRequest *']	2	0	179	32	13	50	0	108	61
uWS::HttpContext ::init()::{lambda(us_socket_t*)#1}::__invoke(us_socket_t*)	/src/uWebSockets/fuzzing/../src/HttpContext.h	1	['struct.us_socket_t *']	4	0	13	3	2	87	0	174	60
autouWS::TemplatedApp ::ws (std::__1::basic_string ,std::__1::allocator >,uWS::TemplatedApp ::WebSocketBehavior &&)::{lambda(auto:1*,auto:2*)#1}::operator() ,uWS::HttpRequest>(uWS::HttpResponse *,uWS::HttpRequest*)	/src/uWebSockets/fuzzing/../src/App.h	3	['class.anon.254 *', 'struct.uWS::Loop *', 'struct.uWS::HttpRequest *']	10	0	171	16	4	538	0	732	60
uWS::HttpContext ::init()::{lambda(us_socket_t*,char*,int)#1}::operator()(us_socket_t*,char*,int)const::{lambda(void*,uWS::HttpRequest*)#1}::operator()({lambda(us_socket_t*,char*,int)#1},uWS::HttpRequest)const	/src/uWebSockets/fuzzing/../src/HttpContext.h	3	['class.anon.167 *', 'char *', 'struct.uWS::HttpRequest *']	3	0	163	29	12	49	0	105	50

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

900 / 1607

Cyclomatic complexity statically reachable by fuzzers

3579 / 6095

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
uWS::HttpContext ::init()::{lambda(us_socket_t*,char*,int)#1}::operator()(us_socket_t*,char*,int)const::{lambda(void*,uWS::HttpRequest*)#1}::operator()({lambda(us_socket_t*,char*,int)#1},uWS::HttpRequest)const	42	22	52.38%	[]
uWS::HttpResponse ::internalEnd(std::__1::basic_string_view >,unsignedlong,bool,bool,bool)	74	32	43.24%	[]
uWS::HttpRouter ::RouterData>::executeHandlers(uWS::HttpRouter ::RouterData>::Node*,int,uWS::HttpContextData ::RouterData&)	31	14	45.16%	[]
uWS::WebSocket ::send(std::__1::basic_string_view >,uWS::OpCode,bool,bool)	63	32	50.79%	[]
unsignedlonguWS::protocol::formatMessage (char*,charconst*,unsignedlong,uWS::OpCode,unsignedlong,bool,bool)	38	20	52.63%	['EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/uWebSockets/fuzzing/./../src/WebSocketProtocol.h	['WebSocket']	[]
/src/uWebSockets/fuzzing/EpollEchoServer.cpp	['EpollEchoServer']	['EpollEchoServer']
/src/uWebSockets/fuzzing/./helpers.h	['PerMessageDeflate', 'TopicTree', 'WebSocket', 'Http', 'HttpWithProxy']	[]
/src/uWebSockets/fuzzing/Extensions.cpp	['Extensions']	['Extensions']
/src/uWebSockets/fuzzing/./../src/MessageParser.h	['MultipartParser']	[]
/src/uWebSockets/fuzzing/./../src/ChunkedEncoding.h	[]	[]
/usr/local/bin/../include/c++/v1/math.h	[]	[]
/src/uWebSockets/fuzzing/PerMessageDeflate.cpp	['PerMessageDeflate']	['PerMessageDeflate']
/src/uWebSockets/fuzzing/../src/HttpParser.h	[]	[]
/src/uWebSockets/fuzzing/../src/BloomFilter.h	[]	[]
/src/uWebSockets/fuzzing/../src/HttpContextData.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/Loop.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/./../src/TopicTree.h	['TopicTree']	[]
/src/uWebSockets/fuzzing/../src/WebSocketHandshake.h	[]	[]
/src/uWebSockets/fuzzing/../uSockets/src/context.c	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/WebSocketContextData.h	['EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/./../src/PerMessageDeflate.h	['PerMessageDeflate']	[]
/src/uWebSockets/fuzzing/../src/WebSocket.h	[]	[]
/src/uWebSockets/fuzzing/../src/LoopData.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/usr/local/bin/../include/c++/v1/charconv	[]	[]
/src/uWebSockets/fuzzing/./../src/BloomFilter.h	[]	[]
/src/uWebSockets/fuzzing/../src/WebSocketData.h	[]	[]
/src/uWebSockets/fuzzing/../src/WebSocketContext.h	['EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../uSockets/src/eventing/epoll_kqueue.c	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/QueryParser.h	[]	[]
/src/uWebSockets/fuzzing/../src/ChunkedEncoding.h	[]	[]
/src/uWebSockets/fuzzing/Http.cpp	['Http', 'HttpWithProxy']	['Http', 'HttpWithProxy']
/src/uWebSockets/fuzzing/../src/HttpResponseData.h	[]	[]
/src/uWebSockets/fuzzing/../src/App.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/TopicTree.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/./libEpollFuzzer/epoll_fuzzer.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/usr/include/ctype.h	['MultipartParser', 'Extensions']	[]
/src/uWebSockets/fuzzing/../src/PerMessageDeflate.h	['EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/HttpRouter.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/HttpContext.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../uSockets/src/bsd.c	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/QueryParser.cpp	['QueryParser']	['QueryParser']
/src/uWebSockets/fuzzing/EpollEchoServerPubSub.cpp	['EpollEchoServerPubSub']	['EpollEchoServerPubSub']
/usr/include/x86_64-linux-gnu/bits/socket.h	[]	[]
/src/uWebSockets/fuzzing/../src/AsyncSocketData.h	[]	[]
/src/uWebSockets/fuzzing/./../src/Multipart.h	['MultipartParser']	[]
/src/uWebSockets/fuzzing/./../src/HttpParser.h	['Http', 'HttpWithProxy']	[]
/src/uWebSockets/fuzzing/../src/WebSocketProtocol.h	[]	[]
/usr/local/bin/../include/c++/v1/stdexcept	[]	[]
/src/uWebSockets/fuzzing/../src/WebSocketExtensions.h	[]	[]
/src/uWebSockets/fuzzing/../uSockets/src/loop.c	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/MoveOnlyFunction.h	['AsyncEpollHelloWorld', 'EpollEchoServerPubSub', 'EpollEchoServer', 'EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/MultipartParser.cpp	['MultipartParser']	['MultipartParser']
/src/uWebSockets/fuzzing/../uSockets/src/socket.c	['EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/AsyncSocket.h	[]	[]
/usr/local/bin/../include/c++/v1/exception	[]	[]
/src/uWebSockets/fuzzing/./../src/ProxyParser.h	['HttpWithProxy']	[]
/src/uWebSockets/fuzzing/WebSocket.cpp	['WebSocket']	['WebSocket']
/src/uWebSockets/fuzzing/../uSockets/src/udp.c	[]	[]
/src/uWebSockets/fuzzing/./../src/MoveOnlyFunction.h	[]	[]
/src/uWebSockets/fuzzing/./../src/QueryParser.h	['QueryParser']	[]
/src/uWebSockets/fuzzing/./../src/HttpRouter.h	[]	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['EpollHelloWorld']	[]
/src/uWebSockets/fuzzing/../src/HttpResponse.h	[]	[]
/usr/local/bin/../include/c++/v1/optional	['MultipartParser']	[]
/src/uWebSockets/fuzzing/TopicTree.cpp	['TopicTree']	['TopicTree']
/src/uWebSockets/fuzzing/./../src/WebSocketExtensions.h	['Extensions']	[]
/src/uWebSockets/fuzzing/../src/Utilities.h	[]	[]
/src/uWebSockets/fuzzing/AsyncEpollHelloWorld.cpp	['AsyncEpollHelloWorld']	['AsyncEpollHelloWorld']
/src/uWebSockets/fuzzing/EpollHelloWorld.cpp	['EpollHelloWorld']	['EpollHelloWorld']

Directories in report

Directory
/src/uWebSockets/fuzzing/./
/src/uWebSockets/fuzzing/../src/
/usr/include/
/usr/local/bin/../include/c++/v1/
/usr/include/x86_64-linux-gnu/bits/
/src/uWebSockets/fuzzing/
/src/uWebSockets/fuzzing/./../src/
/src/uWebSockets/fuzzing/../uSockets/src/
/src/uWebSockets/fuzzing/../uSockets/src/eventing/
/src/uWebSockets/fuzzing/./libEpollFuzzer/