Project overview

High level conclusions

Fuzzers reach 25.09% of cyclomatic complexity. Improvements could be made

Fuzzers reach 23.79% of all functions. Improvements need to be made

Fuzzer fuzz_xml is blocked: runtime coverage only covers 0.0% of its reachable functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

74/311

Cyclomatic complexity statically reachable by fuzzers

403/1606

Functions covered at runtime

Fuzzers overview

Fuzzer	Fuzzer filename	Functions Reached	Functions unreached	Fuzzer depth	Files reached	Basic blocks reached	Cyclomatic complexity	Details
fuzz_xml	fuzz_xml.c	74	237	16	12	784	403	fuzz_xml.c

Project functions overview

The following table shows data about each function in the project. The functions included in this table corresponds to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer details

Fuzzer: fuzz_xml

Call tree overview

The following is the call tree with color coding for which functions are hit/not hit. This info is based on the coverage achieved of all fuzzers together and not just this specific fuzzer. This should change in the future to be per-fuzzer-basis.

For further technical details on what the call tree overview is, please see the Glossary .

Full calltree

The following link provides a visualisation of the full calltree overlayed with coverage information: full calltree

For futher technical details on how the call tree is made, please see the Glossary .

Fuzz blockers

The followings nodes represent call sites where fuzz blockers occur

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
197	0	EP	call site	_log

Functions hit (dynamic analysis based)

Covered functions

Functions that are reachable but not covered

Reachable functions

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation our of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files hit

filename	functions hit
fuzz_xml.c	1
/	44
wazuhos_xml/os_xml.c	11
wazuhshared/file_op.c	3
wazuhshared/debug_op.c	6
wazuhshared/time_op.c	1
wazuhos_xml/os_xml_access.c	2
//usr/include/x86_64-linux-gnu/sys/stat.h	1
wazuhshared/privsep_op.c	2
wazuhos_regex/os_regex_strbreak.c	1
wazuhshared/string_op.c	1
wazuhos_xml/os_xml_node_access.c	2

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination reaches a high amount of code coverage.

Func name	Functions filename	Arg count	Args	Function depth	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
`is_ascii_utf8`	/src/wazuh/src/shared/file_op.c	3	['char *', 'int ', 'int ']	15	658	158	68	76	0	441	80
`UnmergeFiles`	/src/wazuh/src/shared/file_op.c	3	['char ', 'char ', 'int ']	17	213	48	18	85	0	433	64
`w_uncompress_bz2_gz_file`	/src/wazuh/src/shared/file_op.c	2	['char ', 'char ']	18	51	12	5	87	0	430	63
`cldir_ex_ignore`	/src/wazuh/src/shared/file_op.c	2	['char ', 'char *']	4	101	25	11	12	3	50	42

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

116/311