High level conclusions

Fuzzers reach 55.94% of cyclomatic complexity.

Fuzzers reach 46.18% of all functions.

Fuzzer libwget_http_client_fuzzer is blocked:

The runtime code coverage of libwget_http_client_fuzzer covers 9.231% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

2304 / 4989

Cyclomatic complexity statically reachable by fuzzers

22972 / 41064

Runtime code coverage of functions

718 / 4989

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: libwget_robots_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	2.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	2.5%
lawngreen	50+	38	95.0%
All colors	40	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	6	298	wget_robots_parse	call site: 00004	/src/wget2/libwget/robots.c:84
0	0	None	6	298	wget_robots_parse	call site: 00013	/src/wget2/libwget/robots.c:108
0	0	None	6	298	wget_robots_parse	call site: 00022	/src/wget2/libwget/robots.c:114
0	0	None	6	298	wget_robots_parse	call site: 00032	/src/wget2/libwget/robots.c:131
0	0	None	0	37	wget_strncasecmp_ascii	call site: 00005	/src/wget2/libwget/utils.c:161
0	0	None	0	37	wget_strncasecmp_ascii	call site: 00005	/src/wget2/libwget/utils.c:167
0	0	None	0	27	wget_vector_add_memdup	call site: 00024	/src/wget2/libwget/vector.c:224
0	0	None	0	21	wget_vector_add_memdup	call site: 00025	/src/wget2/libwget/vector.c:227
0	0	None	0	16	wget_robots_parse	call site: 00033	/src/wget2/libwget/robots.c:133
0	0	None	0	2	wget_vector_create	call site: 00014	/src/wget2/libwget/vector.c:73
0	0	None	0	0	c_strncasecmp	call site: 00006	/src/wget2/lib/c-strncasecmp.c:33
0	0	None	0	0	wget_memdup	call site: 00026	/src/wget2/libwget/mem.c:59

Runtime coverage analysis

Covered functions

20

Functions that are reachable but not covered

5

Reachable functions

25

Percentage of reachable functions covered

80.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_robots_parse_fuzzer.c	1
/src/wget2/libwget/robots.c	3
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/utils.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/./c-ctype.h	1
/src/wget2/libwget/vector.c	7
/src/wget2/lib/free.c	1
/src/wget2/libwget/mem.c	2

Fuzzer: libwget_tlssess_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	117	48.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.83%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	121	50.4%
All colors	240	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__freading', 'fileno', 'rpl_fflush', '__errno_location', 'lseek']	35	35	rpl_fclose	call site: 00135	/src/wget2/lib/fclose.c:66
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00029	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00120	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00178	/src/wget2/libwget/io.c:123
2	2	1 : View List ['gettext']	2	2	wget_tls_session_db_load	call site: 00169	/src/wget2/libwget/tls_session.c:354
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00166	/src/wget2/libwget/io.c:520
0	9	1 : View List ['wget_tls_session_free']	0	31	wget_tls_session_db_add	call site: 00203	/src/wget2/libwget/tls_session.c:219
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00028	/src/wget2/libwget/buffer_printf.c:346
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00033	/src/wget2/libwget/buffer_printf.c:368
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00036	/src/wget2/libwget/buffer_printf.c:372
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:377
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00045	/src/wget2/libwget/buffer_printf.c:395

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

45

Reachable functions

112

Percentage of reachable functions covered

59.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_tlssess_fuzzer.c	2
/src/wget2/libwget/tls_session.c	11
/src/wget2/libwget/hashmap.c	13
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/lib/free.c	1
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/io.c	3
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/mem.c	2
/src/wget2/libwget/base64.c	3

Fuzzer: libwget_ocsp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	47.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.74%
lawngreen	50+	140	52.2%
All colors	268	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__freading', 'fileno', 'rpl_fflush', '__errno_location', 'lseek']	35	35	rpl_fclose	call site: 00147	/src/wget2/lib/fclose.c:66
16	16	1 : View List ['wget_hashmap_remove']	16	30	ocsp_db_add_fingerprint_entry	call site: 00231	/src/wget2/libwget/ocsp.c:282
16	16	1 : View List ['wget_hashmap_remove']	16	30	ocsp_db_add_host_entry	call site: 00210	/src/wget2/libwget/ocsp.c:347
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00039	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00132	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00190	/src/wget2/libwget/io.c:123
2	2	1 : View List ['gettext']	2	2	wget_ocsp_db_load	call site: 00249	/src/wget2/libwget/ocsp.c:521
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00178	/src/wget2/libwget/io.c:520
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:346
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00043	/src/wget2/libwget/buffer_printf.c:368
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00046	/src/wget2/libwget/buffer_printf.c:372
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00048	/src/wget2/libwget/buffer_printf.c:377

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

47

Reachable functions

113

Percentage of reachable functions covered

58.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_ocsp_fuzzer.c	2
/src/wget2/libwget/ocsp.c	15
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/hashmap.c	12
/src/wget2/lib/free.c	1
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/libwget/io.c	3
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1

Fuzzer: libwget_netrc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	26	24.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.85%
lawngreen	50+	80	74.0%
All colors	108	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__freading', 'fileno', 'rpl_fflush', '__errno_location', 'lseek']	35	35	rpl_fclose	call site: 00047	/src/wget2/lib/fclose.c:66
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00020	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00037	/src/wget2/libwget/io.c:123
0	0	None	34	387	wget_netrc_db_load	call site: 00018	/src/wget2/libwget/netrc.c:197
0	0	None	34	355	wget_netrc_db_load	call site: 00019	/src/wget2/libwget/netrc.c:200
0	0	None	34	355	wget_netrc_db_load	call site: 00044	/src/wget2/libwget/netrc.c:235
0	0	None	14	14	getline_internal	call site: 00032	/src/wget2/libwget/io.c:67
0	0	None	12	12	getline_internal	call site: 00033	/src/wget2/libwget/io.c:72
0	0	None	2	2	wget_strcmp	call site: 00000	/src/wget2/libwget/utils.c:79
0	0	None	2	2	wget_strcmp	call site: 00000	/src/wget2/libwget/utils.c:85
0	0	None	0	47	wget_netrc_db_add	call site: 00064	/src/wget2/libwget/netrc.c:160
0	0	None	0	37	wget_netrc_db_add	call site: 00064	/src/wget2/libwget/netrc.c:163

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

25

Reachable functions

67

Percentage of reachable functions covered

62.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_netrc_fuzzer.c	2
/src/wget2/libwget/netrc.c	11
/src/wget2/libwget/hashmap.c	11
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/lib/free.c	1
/src/wget2/lib/fopen.c	2
/src/wget2/libwget/io.c	2
/src/wget2/libwget/log.c	2
/src/wget2/libwget/mem.c	3
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/utils.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/./c-ctype.h	1

Fuzzer: libwget_hpkp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	116	44.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.38%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	146	55.5%
All colors	263	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__freading', 'fileno', 'rpl_fflush', '__errno_location', 'lseek']	35	35	rpl_fclose	call site: 00136	/src/wget2/lib/fclose.c:66
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00030	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00121	/src/wget2/lib/fopen.c:211
7	7	2 : View List ['wget_calloc.143', 'hashmap_rehash']	7	7	hashmap_new_entry	call site: 00199	/src/wget2/libwget/hashmap.c:249
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00179	/src/wget2/libwget/io.c:123
4	4	2 : View List ['strchr', 'strlen']	16	16	get_x86_features	call site: 00000	/src/nettle/fat-x86_64.c:76
2	2	1 : View List ['memcmp']	6	6	get_x86_features	call site: 00000	/src/nettle/fat-x86_64.c:104
2	2	1 : View List ['gettext']	2	2	wget_hpkp_db_check_pubkey	call site: 00244	/src/wget2/libwget/hpkp_db.c:158
2	2	1 : View List ['gettext']	2	2	wget_hpkp_db_load	call site: 00170	/src/wget2/libwget/hpkp_db.c:359
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00167	/src/wget2/libwget/io.c:520
0	4	1 : View List ['nettle_sha256_compress']	0	6	nettle_sha256_update	call site: 00000	/src/nettle/sha256.c:108
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00029	/src/wget2/libwget/buffer_printf.c:346

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

48

Reachable functions

128

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_hpkp_fuzzer.c	2
/src/wget2/libwget/hpkp_db.c	8
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/mem.c	2
/src/wget2/libwget/hashmap.c	11
/src/wget2/lib/free.c	1
/src/wget2/libwget/hpkp.c	5
/src/wget2/libwget/vector.c	8
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/io.c	3
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/base64.c	4
/src/wget2/libwget/hashfile.c	5

Fuzzer: libwget_sitemap_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	71	48.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.68%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	75	51.0%
All colors	147	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00046	/src/wget2/libwget/buffer_printf.c:75
25	25	1 : View List ['getHTMLValue']	25	25	getValue	call site: 00104	/src/wget2/libwget/xml.c:251
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00044	/src/wget2/libwget/buffer_printf.c:66
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:346
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:359
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:363
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00023	/src/wget2/libwget/buffer_printf.c:368
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00026	/src/wget2/libwget/buffer_printf.c:372
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00028	/src/wget2/libwget/buffer_printf.c:377
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:395
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:407
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:408

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

16

Reachable functions

56

Percentage of reachable functions covered

71.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_sitemap_url_fuzzer.c	1
/src/wget2/libwget/sitemap_url.c	2
/src/wget2/libwget/xml.c	12
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	1
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	3
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/vector.c	5
/src/wget2/lib/free.c	1

Fuzzer: libwget_http_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	1.28%
gold	[1:9]	7	2.24%
yellow	[10:29]	1	0.32%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	300	96.1%
All colors	312	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	11	1 : View List ['wget_cookie_free']	0	11	wget_cookie_parse_setcookie	call site: 00269	/src/wget2/libwget/cookie_parse.c:368
0	6	1 : View List ['wget_strmemdup']	0	6	wget_memiconv	call site: 00075	/src/wget2/libwget/encoding.c:76
0	0	None	20	66	wget_memiconv	call site: 00074	/src/wget2/libwget/encoding.c:67
0	0	None	20	66	wget_memiconv	call site: 00074	/src/wget2/libwget/encoding.c:71
0	0	None	20	66	wget_memiconv	call site: 00074	/src/wget2/libwget/encoding.c:73
0	0	None	16	722	wget_http_parse_response_header	call site: 00003	/src/wget2/libwget/http_parse.c:1252
0	0	None	12	12	wget_memiconv	call site: 00077	/src/wget2/libwget/encoding.c:86
0	0	None	6	2514	wget_http_parse_header_line	call site: 00018	/src/wget2/libwget/http_parse.c:1072
0	0	None	6	2508	wget_http_parse_header_line	call site: 00019	/src/wget2/libwget/http_parse.c:1080
0	0	None	2	243	wget_http_parse_link	call site: 00160	/src/wget2/libwget/http_parse.c:299
0	0	None	2	85	wget_striconv	call site: 00072	/src/wget2/libwget/encoding.c:142
0	0	None	2	79	wget_hpkp_pin_add	call site: 00183	/src/wget2/libwget/hpkp.c:85

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

20

Reachable functions

114

Percentage of reachable functions covered

82.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_http_parse_fuzzer.c	1
/src/wget2/libwget/http_parse.c	33
/src/wget2/libwget/../include/wget/wget.h	5
/src/wget2/libwget/log.c	2
/src/wget2/lib/./c-ctype.h	4
/src/wget2/libwget/mem.c	4
/src/wget2/libwget/utils.c	5
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/encoding.c	5
/src/wget2/libwget/vector.c	7
/src/wget2/lib/free.c	1
/src/wget2/libwget/hpkp.c	7
/src/wget2/libwget/base64.c	4
/src/wget2/libwget/stringmap.c	2
/src/wget2/libwget/hashmap.c	7
/src/wget2/libwget/cookie_parse.c	4
/src/wget2/libwget/buffer.c	2

Fuzzer: libwget_utils_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	171	59.3%
gold	[1:9]	1	0.34%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	116	40.2%
All colors	288	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
36	67	8 : View List ['getenv', 'scratch_buffer_init', 'getpwnam_r', 'glob_use_alloca', 'scratch_buffer_free', 'getlogin_r', 'gl_scratch_buffer_grow', 'memchr']	112	921	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:602
17	17	1 : View List ['wget_buffer_memset_append']	17	35	convert_dec	call site: 00255	/src/wget2/libwget/buffer_printf.c:219
17	17	1 : View List ['wget_buffer_memset_append']	17	35	convert_dec	call site: 00258	/src/wget2/libwget/buffer_printf.c:227
13	21	5 : View List ['strcpy', 'is_dir', 'strlen', 'realloc', 'rpl_globfree']	15	27	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:1149
11	11	1 : View List ['rpl_nanosleep']	11	11	wget_millisleep	call site: 00039	/src/wget2/libwget/utils.c:284
5	5	1 : View List ['glob_lstat']	19	44	glob_in_dir	call site: 00133	/src/wget2/lib/glob.c:1303
2	2	1 : View List ['strchr']	34	193	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:1095
2	2	1 : View List ['strdup']	19	71	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:1120
2	2	2 : View List ['strlen', 'malloc']	10	29	glob_in_dir	call site: 00158	/src/wget2/lib/glob.c:1438
2	2	1 : View List ['__errno_location']	2	2	rpl_glob	call site: 00063	/src/wget2/lib/glob.c:303
0	444	1 : View List ['rpl_glob']	32	659	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:955
0	0	None	306	396	convert_dec	call site: 00237	/src/wget2/libwget/buffer_printf.c:162

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

51

Reachable functions

95

Percentage of reachable functions covered

46.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_utils_fuzzer.c	1
/src/wget2/libwget/utils.c	17
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/./c-ctype.h	4
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/nanosleep.c	1
/src/wget2/lib/gettime.c	1
/src/wget2/libwget/mem.c	1
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/lib/glob.c	10
/src/wget2/lib/free.c	1
/src/wget2/lib/globfree.c	1
/src/wget2/lib/./malloc/scratch_buffer.gl.h	2
/src/wget2/lib/malloc/scratch_buffer_grow.c	1
/src/wget2/lib/./glob_internal.h	1
/src/wget2/lib/malloc/scratch_buffer_set_array_size.c	1
/src/wget2/libwget/printf.c	4
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/ioctl.c	1

Fuzzer: libwget_atom_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	70	40.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	103	59.5%
All colors	173	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00046	/src/wget2/libwget/buffer_printf.c:75
25	25	1 : View List ['getHTMLValue']	25	25	getValue	call site: 00104	/src/wget2/libwget/xml.c:251
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00044	/src/wget2/libwget/buffer_printf.c:66
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:346
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:359
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:363
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00023	/src/wget2/libwget/buffer_printf.c:368
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00026	/src/wget2/libwget/buffer_printf.c:372
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00028	/src/wget2/libwget/buffer_printf.c:377
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:395
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:407
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:408

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

15

Reachable functions

59

Percentage of reachable functions covered

74.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_atom_url_fuzzer.c	1
/src/wget2/libwget/atom_url.c	2
/src/wget2/libwget/xml.c	12
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	1
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	3
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/vector.c	5
/src/wget2/lib/free.c	1
/src/wget2/libwget/rss_url.c	2

Fuzzer: libwget_bar_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	43	23.4%
gold	[1:9]	2	1.09%
yellow	[10:29]	1	0.54%
greenyellow	[30:49]	1	0.54%
lawngreen	50+	136	74.3%
All colors	183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	179	1 : View List ['wget_human_readable']	0	179	bar_update_speed_stats	call site: 00105	/src/wget2/libwget/bar.c:177
0	17	1 : View List ['wget_buffer_memset_append']	0	35	convert_dec	call site: 00088	/src/wget2/libwget/buffer_printf.c:219
0	2	1 : View List ['wget_malloc']	0	213	wget_bar_vprintf	call site: 00154	/src/wget2/libwget/bar.c:659
0	0	None	22	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:346
0	0	None	22	645	wget_buffer_vprintf_append	call site: 00045	/src/wget2/libwget/buffer_printf.c:377
0	0	None	22	645	wget_buffer_vprintf_append	call site: 00055	/src/wget2/libwget/buffer_printf.c:408
0	0	None	2	342	wget_bar_set_slots	call site: 00016	/src/wget2/libwget/bar.c:492
0	0	None	2	2	wget_strlcpy	call site: 00108	/src/wget2/libwget/strlcpy.c:51
0	0	None	2	2	wget_thread_mutex_init	call site: 00011	/src/wget2/libwget/thread.c:87
0	0	None	0	396	convert_dec	call site: 00071	/src/wget2/libwget/buffer_printf.c:162
0	0	None	0	322	wget_bar_init	call site: 00004	/src/wget2/libwget/bar.c:463
0	0	None	0	322	wget_bar_init	call site: 00009	/src/wget2/libwget/bar.c:464

Runtime coverage analysis

Covered functions

59

Functions that are reachable but not covered

24

Reachable functions

79

Percentage of reachable functions covered

69.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_bar_fuzzer.c	1
/src/wget2/libwget/bar.c	19
/src/wget2/libwget/utils.c	3
/src/wget2/lib/ioctl.c	1
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/printf.c	6
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/gettime.c	1
/src/wget2/libwget/strlcpy.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/mem.c	2

Fuzzer: libwget_metalink_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	150	30.8%
gold	[1:9]	1	0.20%
yellow	[10:29]	4	0.82%
greenyellow	[30:49]	1	0.20%
lawngreen	50+	331	67.9%
All colors	487	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00358	/src/libidn2/lib/idna.c:233
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00047	/src/wget2/libwget/buffer_printf.c:75
25	25	1 : View List ['getHTMLValue']	25	25	getValue	call site: 00105	/src/wget2/libwget/xml.c:251
6	927	9 : View List ['_idn2_label_test', 'idn2_punycode_decode', 'get_idna_map', 'malloc', 'u32_normalize', 'map_is', '__errno_location', 'get_map_data', 'u32_to_u8']	6	967	_tr46	call site: 00257	/src/libidn2/lib/lookup.c:288
6	6	1 : View List ['__errno_location']	6	14	u32_normalize	call site: 00304	/src/libunistring/lib/uninorm/u-normalize-internal.h:345
6	6	1 : View List ['wget_strmemdup']	6	6	wget_memiconv	call site: 00217	/src/wget2/libwget/encoding.c:76
4	4	2 : View List ['__errno_location', 'gettext']	6	6	wget_memiconv	call site: 00221	/src/wget2/libwget/encoding.c:92
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00045	/src/wget2/libwget/buffer_printf.c:66
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00333	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00306	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['__errno_location']	2	2	u32_to_u8	call site: 00322	/src/libunistring/lib/unistr/u32-to-u8.c:111

Runtime coverage analysis

Covered functions

134

Functions that are reachable but not covered

38

Reachable functions

166

Percentage of reachable functions covered

77.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_metalink_parse_fuzzer.c	1
/src/wget2/libwget/metalink.c	9
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/xml.c	12
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	2
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/utils.c	3
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/mem.c	4
/src/wget2/libwget/vector.c	11
/src/wget2/lib/free.c	1
/src/wget2/libwget/strscpy.c	1
/src/wget2/libwget/iri.c	7
/src/wget2/libwget/encoding.c	5
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1

Fuzzer: libwget_css_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	347	70.8%
gold	[1:9]	1	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.40%
lawngreen	50+	140	28.5%
All colors	490	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
91	91	1 : View List ['wget_str_to_utf8']	91	91	wget_iri_parse	call site: 00269	/src/wget2/libwget/iri.c:670
82	82	8 : View List ['clearerr', 'getc', 'ferror', 'yyrestart', '__errno_location', 'fread', 'yyrealloc', 'wget_error_printf_exit']	82	82	yy_get_next_buffer	call site: 00313	/src/wget2/libwget/css_tokenizer.c:3108
4	4	2 : View List ['strrchr', 'strlen']	372	1177	wget_iri_parse	call site: 00030	/src/wget2/libwget/iri.c:600
2	16	2 : View List ['c_isdigit', 'atoi']	368	1173	wget_iri_parse	call site: 00032	/src/wget2/libwget/iri.c:616
2	2	1 : View List ['strchr']	374	1179	wget_iri_parse	call site: 00029	/src/wget2/libwget/iri.c:591
2	2	1 : View List ['strlen']	8	650	wget_iri_relative_to_abs	call site: 00375	/src/wget2/libwget/iri.c:874
2	2	1 : View List ['__errno_location']	2	2	yylex_init	call site: 00276	/src/wget2/libwget/css_tokenizer.c:3920
0	153	1 : View List ['wget_buffer_printf_append']	0	153	wget_iri_get_connection_part	call site: 00465	/src/wget2/libwget/iri.c:763
0	67	1 : View List ['wget_iri_unescape_inline']	378	1250	wget_iri_parse	call site: 00025	/src/wget2/libwget/iri.c:578
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00404	/src/wget2/libwget/buffer_printf.c:346
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00405	/src/wget2/libwget/buffer_printf.c:359
0	0	None	384	1687	wget_iri_parse	call site: 00002	/src/wget2/libwget/iri.c:439

Runtime coverage analysis

Covered functions

71

Functions that are reachable but not covered

103

Reachable functions

173

Percentage of reachable functions covered

40.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_css_url_fuzzer.c	1
/src/wget2/libwget/iri.c	9
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/utils.c	3
/src/wget2/libwget/log.c	3
/src/wget2/libwget/encoding.c	5
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/mem.c	1
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/css_url.c	4
/src/wget2/libwget/css.c	3
/src/wget2/libwget/css_tokenizer.c	21
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/vector.c	8
/src/wget2/libwget/buffer.c	9
/src/wget2/libwget/strscpy.c	1
/src/wget2/libwget/buffer_printf.c	9

Fuzzer: libwget_html_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	132	42.9%
gold	[1:9]	1	0.32%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	174	56.6%
All colors	307	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
82	82	8 : View List ['clearerr', 'getc', 'ferror', 'yyrestart', '__errno_location', 'fread', 'yyrealloc', 'wget_error_printf_exit']	82	82	yy_get_next_buffer	call site: 00207	/src/wget2/libwget/css_tokenizer.c:3108
2	2	1 : View List ['__errno_location']	2	2	yylex_init	call site: 00170	/src/wget2/libwget/css_tokenizer.c:3920
0	54	1 : View List ['getToken']	0	54	getValue	call site: 00105	/src/wget2/libwget/xml.c:251
0	6	1 : View List ['wget_strmemdup']	0	83	wget_http_parse_content_type	call site: 00145	/src/wget2/libwget/http_parse.c:481
0	0	None	50	1313	html_get_url	call site: 00163	/src/wget2/libwget/html_url.c:209
0	0	None	12	99	yylex	call site: 00203	/src/wget2/libwget/css_tokenizer.c:2651
0	0	None	12	97	yylex	call site: 00203	/src/wget2/libwget/css_tokenizer.c:2990
0	0	None	12	97	yylex	call site: 00206	/src/wget2/libwget/css_tokenizer.c:3027
0	0	None	10	1102	parseXML	call site: 00005	/src/wget2/libwget/xml.c:445
0	0	None	10	1102	parseXML	call site: 00013	/src/wget2/libwget/xml.c:466
0	0	None	10	1102	parseXML	call site: 00088	/src/wget2/libwget/xml.c:488
0	0	None	10	1102	parseXML	call site: 00104	/src/wget2/libwget/xml.c:535

Runtime coverage analysis

Covered functions

65

Functions that are reachable but not covered

42

Reachable functions

107

Percentage of reachable functions covered

60.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_html_url_fuzzer.c	1
/src/wget2/libwget/html_url.c	4
/src/wget2/libwget/xml.c	13
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	3
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	4
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/http_parse.c	6
/src/wget2/libwget/vector.c	8
/src/wget2/libwget/css.c	3
/src/wget2/libwget/css_tokenizer.c	21
/src/wget2/lib/free.c	1
/src/wget2/libwget/strscpy.c	1

Fuzzer: libwget_hsts_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	49.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	1.21%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	122	49.5%
All colors	246	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__freading', 'fileno', 'rpl_fflush', '__errno_location', 'lseek']	35	35	rpl_fclose	call site: 00139	/src/wget2/lib/fclose.c:66
16	16	1 : View List ['wget_hashmap_remove']	16	34	hsts_db_add_entry	call site: 00204	/src/wget2/libwget/hsts.c:266
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00033	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00124	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00182	/src/wget2/libwget/io.c:123
2	2	1 : View List ['gettext']	2	2	wget_hsts_db_load	call site: 00173	/src/wget2/libwget/hsts.c:458
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00170	/src/wget2/libwget/io.c:520
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00032	/src/wget2/libwget/buffer_printf.c:346
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00037	/src/wget2/libwget/buffer_printf.c:368
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00040	/src/wget2/libwget/buffer_printf.c:372
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00042	/src/wget2/libwget/buffer_printf.c:377
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00049	/src/wget2/libwget/buffer_printf.c:395

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

50

Reachable functions

113

Percentage of reachable functions covered

55.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_hsts_fuzzer.c	2
/src/wget2/libwget/hsts.c	11
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/hashmap.c	12
/src/wget2/lib/free.c	1
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/io.c	3
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/ip.c	1

Fuzzer: libwget_xml_parse_buffer_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	59	39.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	92	60.9%
All colors	151	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00045	/src/wget2/libwget/buffer_printf.c:75
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00043	/src/wget2/libwget/buffer_printf.c:66
2	2	1 : View List ['gettext']	2	2	wget_xml_parse_file	call site: 00136	/src/wget2/libwget/xml.c:652
0	433	1 : View List ['wget_xml_parse_buffer']	4	437	wget_xml_parse_file	call site: 00138	/src/wget2/libwget/xml.c:665
0	433	1 : View List ['wget_xml_parse_buffer']	0	438	wget_xml_parse_file	call site: 00146	/src/wget2/libwget/xml.c:692
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00017	/src/wget2/libwget/buffer_printf.c:346
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:359
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:363
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00022	/src/wget2/libwget/buffer_printf.c:368
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00025	/src/wget2/libwget/buffer_printf.c:372
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00027	/src/wget2/libwget/buffer_printf.c:377
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00034	/src/wget2/libwget/buffer_printf.c:395

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

20

Reachable functions

60

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_xml_parse_buffer_fuzzer.c	2
/src/wget2/libwget/xml.c	15
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	2
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	2
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1

Fuzzer: libwget_base64_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	62	69.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	30.3%
All colors	89	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00016	/src/wget2/libwget/buffer.c:384
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00015	/src/wget2/libwget/buffer_printf.c:346
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00015	/src/wget2/libwget/buffer_printf.c:356
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00016	/src/wget2/libwget/buffer_printf.c:359
0	0	None	0	8	wget_base64_decode_alloc	call site: 00006	/src/wget2/libwget/base64.c:158
0	0	None	0	0	wget_base64_decode_alloc	call site: 00007	/src/wget2/libwget/base64.c:163
0	0	None	0	0	wget_base64_encode_vprintf_alloc	call site: 00011	/src/wget2/libwget/base64.c:278
0	0	None	0	0	wget_buffer_init	call site: 00012	/src/wget2/libwget/buffer.c:155
0	0	None	0	0	wget_buffer_init	call site: 00012	/src/wget2/libwget/buffer.c:161
0	0	None	0	0	wget_buffer_init	call site: 00013	/src/wget2/libwget/buffer.c:164
0	0	None	0	0	wget_vasprintf	call site: 00014	/src/wget2/libwget/printf.c:64

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

13

Reachable functions

33

Percentage of reachable functions covered

60.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_base64_fuzzer.c	1
/src/wget2/libwget/base64.c	11
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/libwget/printf.c	1
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1

Fuzzer: libwget_iri_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	25.1%
gold	[1:9]	1	0.20%
yellow	[10:29]	1	0.20%
greenyellow	[30:49]	2	0.41%
lawngreen	50+	356	74.0%
All colors	481	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00194	/src/libidn2/lib/idna.c:233
6	927	9 : View List ['_idn2_label_test', 'idn2_punycode_decode', 'get_idna_map', 'malloc', 'u32_normalize', 'map_is', '__errno_location', 'get_map_data', 'u32_to_u8']	6	967	_tr46	call site: 00093	/src/libidn2/lib/lookup.c:288
6	6	1 : View List ['__errno_location']	6	14	u32_normalize	call site: 00140	/src/libunistring/lib/uninorm/u-normalize-internal.h:345
4	4	2 : View List ['__errno_location', 'gettext']	6	6	wget_memiconv	call site: 00054	/src/wget2/libwget/encoding.c:92
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00169	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00142	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['__errno_location']	2	2	u32_to_u8	call site: 00158	/src/libunistring/lib/unistr/u32-to-u8.c:111
2	2	2 : View List ['__errno_location', 'malloc']	2	2	u8_to_u32	call site: 00080	/src/libunistring/lib/unistr/u8-to-u32.c:100
0	23	2 : View List ['get_idna_map', 'map_is']	0	23	_idn2_label_test	call site: 00219	/src/libidn2/lib/idna.c:285
0	17	1 : View List ['wget_buffer_memset_append']	0	35	convert_dec	call site: 00372	/src/wget2/libwget/buffer_printf.c:219
0	17	1 : View List ['wget_buffer_memset_append']	0	35	convert_dec	call site: 00375	/src/wget2/libwget/buffer_printf.c:227

Runtime coverage analysis

Covered functions

130

Functions that are reachable but not covered

31

Reachable functions

156

Percentage of reachable functions covered

80.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_iri_fuzzer.c	2
/src/wget2/libwget/iri.c	25
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/libwget/utils.c	3
/src/wget2/libwget/log.c	2
/src/wget2/libwget/encoding.c	6
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/mem.c	3
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/buffer.c	9
/src/wget2/libwget/strscpy.c	1
/src/wget2/libwget/buffer_printf.c	11
/src/wget2/libwget/printf.c	2

Fuzzer: libwget_cookie_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	386	53.0%
gold	[1:9]	4	0.55%
yellow	[10:29]	3	0.41%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	334	45.9%
All colors	727	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
642	642	3 : View List ['psl_idna_close', 'psl_idna_toASCII', 'psl_idna_open']	676	758	is_public_suffix	call site: 00094	/src/libpsl/src/psl.c:881
91	91	1 : View List ['wget_str_to_utf8']	91	91	wget_iri_parse	call site: 00686	/src/wget2/libwget/iri.c:670
24	24	2 : View List ['vector_find', 'vector_get']	28	28	is_public_suffix	call site: 00292	/src/libpsl/src/psl.c:900
10	12	4 : View List ['__errno_location', 'gettext', 'memchr', 'wget_realloc']	10	12	getline_internal	call site: 00410	/src/wget2/libwget/io.c:82
10	12	4 : View List ['__errno_location', 'gettext', 'memchr', 'wget_realloc']	10	12	getline_internal	call site: 00411	/src/wget2/libwget/io.c:101
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00363	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	8	42	wget_update_file	call site: 00397	/src/wget2/libwget/io.c:509
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00412	/src/wget2/libwget/io.c:123
4	4	2 : View List ['strrchr', 'strlen']	372	1177	wget_iri_parse	call site: 00645	/src/wget2/libwget/iri.c:600
2	16	2 : View List ['c_isdigit', 'atoi']	368	1173	wget_iri_parse	call site: 00647	/src/wget2/libwget/iri.c:616
2	2	1 : View List ['strcmp']	382	1539	wget_iri_parse	call site: 00626	/src/wget2/libwget/iri.c:499
2	2	1 : View List ['strchr']	374	1179	wget_iri_parse	call site: 00644	/src/wget2/libwget/iri.c:591

Runtime coverage analysis

Covered functions

132

Functions that are reachable but not covered

144

Reachable functions

276

Percentage of reachable functions covered

47.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_cookie_fuzzer.c	2
/src/wget2/libwget/cookie_parse.c	11
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/http_parse.c	7
/src/wget2/libwget/printf.c	4
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/buffer_printf.c	10
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/cookie.c	14
/src/wget2/libwget/log.c	2
/src/libpsl/src/psl.c	21
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libpsl/src/lookup_string_in_fixed_set.c	10
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/vector.c	14
/src/wget2/libwget/io.c	3
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/utils.c	5
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/iri.c	6
/src/wget2/libwget/encoding.c	5
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1

Fuzzer: wget_options_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	815	53.0%
gold	[1:9]	41	2.67%
yellow	[10:29]	14	0.91%
greenyellow	[30:49]	9	0.58%
lawngreen	50+	656	42.7%
All colors	1535	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1947	5116	9 : View List ['wget_ssl_deinit', 'wget_dns_cache_free', 'wget_http_set_http_proxy', 'wget_cookie_db_save', 'wget_tcp_set_bind_address', 'wget_http_set_no_proxy', 'wget_net_deinit', 'wget_http_set_https_proxy', 'wget_cookie_db_free']	1949	5160	wget_global_deinit	call site: 01206	/src/wget2/libwget/init.c:204
725	2055	19 : View List ['check_phe_sha512', 'check_optimized_aes', 'check_fast_pclmul', 'padlock_capability', '_gnutls_log', 'check_phe_partial', 'check_sha', 'capabilities_to_intel_cpuid', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'read_cpuid_vals', 'capabilities_to_zhaoxin_edx', 'check_ssse3', 'check_phe', 'check_avx_movbe', 'check_pclmul', 'gnutls_crypto_single_cipher_register', 'gnutls_crypto_single_digest_register', 'check_padlock']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
470	479	12 : View List ['fseek', 'ini_ctx_deinit', 'fopen', 'pthread_rwlock_wrlock', 'fclose', '_gnutls_buffer_clear', 'ini_parse_file', 'update_system_wide_priority_string', 'construct_system_wide_priority_string', 'gnutls_strerror', '_name_val_array_clear', 'cfg_apply']	602	611	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2214
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00770	/src/libidn2/lib/idna.c:233
32	41	10 : View List ['is_dir', 'glob_use_alloca', 'readdir_result_type', 'gl_scratch_buffer_set_array_size', 'readdir', 'fstatat', 'dirfd', 'fnmatch', 'convert_dirent', 'strdup']	44	72	glob_in_dir	call site: 00212	/src/wget2/lib/glob.c:1337
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:305
17	26	5 : View List ['scratch_buffer_init', 'getpwnam_r', 'scratch_buffer_free', 'getlogin_r', 'gl_scratch_buffer_grow']	43	860	rpl_glob	call site: 00147	/src/wget2/lib/glob.c:611
16	16	1 : View List ['_asn1_delete_list_and_nodes']	16	16	asn1_array2tree	call site: 00000	/src/gnutls/lib/minitasn1/structure.c:272
12	67	7 : View List ['strcpy', 'is_dir', 'strlen', 'qsort', 'realloc', 'strdup', 'rpl_globfree']	12	71	rpl_glob	call site: 00147	/src/wget2/lib/glob.c:990
12	19	6 : View List ['strcpy', 'is_dir', 'strlen', 'qsort', 'realloc', 'strdup']	12	63	rpl_glob	call site: 00147	/src/wget2/lib/glob.c:1045
12	12	2 : View List ['atoi', '_gnutls_log']	22	1568	lib_init	call site: 00000	/src/gnutls/lib/global.c:516

Runtime coverage analysis

Covered functions

372

Functions that are reachable but not covered

265

Reachable functions

517

Percentage of reachable functions covered

48.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/wget_options_fuzzer.c	3
/src/wget2/src/options.c	30
/src/wget2/libwget/log.c	4
/src/wget2/libwget/utils.c	10
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/vector.c	13
/src/wget2/src/plugin.c	11
/src/wget2/libwget/../include/wget/wget.h	4
/src/wget2/lib/free.c	1
/src/wget2/src/dl.c	10
/src/wget2/libwget/stringmap.c	2
/src/wget2/libwget/hashmap.c	11
/src/wget2/src/../include/wget/wget.h	6
/src/wget2/src/testing.c	2
/src/wget2/libwget/mem.c	5
/src/wget2/lib/glob.c	10
/src/wget2/lib/globfree.c	1
/src/wget2/lib/./malloc/scratch_buffer.gl.h	2
/src/wget2/lib/malloc/scratch_buffer_grow.c	1
/src/wget2/lib/./glob_internal.h	1
/src/wget2/lib/malloc/scratch_buffer_set_array_size.c	1
/src/wget2/libwget/printf.c	7
/src/wget2/libwget/buffer.c	7
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/src/utils.c	1
/src/wget2/src/log.c	1
/src/wget2/libwget/console.c	3
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/src/./wget_dl.h	2
/src/wget2/libwget/strscpy.c	1
/src/wget2/lib/fopen.c	2
/src/wget2/libwget/io.c	3
/src/wget2/lib/fclose.c	1
/src/wget2/libwget/iri.c	9
/src/wget2/lib/./xgetaname-impl.h	1
/src/wget2/lib/xmalloc.c	5
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/encoding.c	6
/src/wget2/libwget/http.c	7
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/gnutls/lib/unistring/unistr/u8-to-u32.c	1
/src/gnutls/lib/unistring/unistr/u8-mbtoucr.c	1
/src/libidn2/lib/tr46map.c	7
/src/gnutls/lib/unistring/uninorm/u-normalize-internal.h	1
/src/gnutls/lib/unistring/unistr/u32-mbtouc-unsafe.c	1
/src/gnutls/lib/unistring/unictype/combiningclass.c	1
/src/gnutls/lib/unistring/./array-mergesort.h	3
/src/gnutls/lib/unistring/unistr/u32-uctomb.c	1
/src/gnutls/lib/unistring/unistr/u-cpy.h	1
/src/gnutls/lib/unistring/unistr/u32-to-u8.c	1
/src/gnutls/lib/unistring/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/gnutls/lib/unistring/unictype/categ_test.c	1
/src/gnutls/lib/unistring/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/gnutls/lib/unistring/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/http_parse.c	2
/src/wget2/libwget/net.c	13
/src/wget2/lib/sockets.c	2
/src/wget2/libwget/dns.c	13
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/dns_cache.c	6
/src/wget2/libwget/ssl_gnutls.c	6
/src/wget2/src/stats_server.c	7
/src/wget2/src/stats_site.c	3
/src/wget2/lib/gettime.c	1
/src/wget2/lib/nanosleep.c	1
/src/wget2/libwget/logger.c	1
/src/wget2/libwget/init.c	2
/src/wget2/libwget/cookie.c	6
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/libwget/cookie_parse.c	6
/src/wget2/lib/c-strncasecmp.c	1
/src/libpsl/src/psl.c	9
/src/libpsl/src/lookup_string_in_fixed_set.c	9
/src/gnutls/lib/cert-cred.c	2
/src/gnutls/lib/x509/verify-high.c	1
/src/gnutls/lib/x509/x509.c	1
/src/gnutls/lib/minitasn1/structure.c	4
/src/gnutls/lib/minitasn1/parser_aux.c	4
/src/gnutls/lib/minitasn1/./parser_aux.h	1
/src/gnutls/lib/minitasn1/./gstr.h	1
/src/gnutls/lib/x509/x509_ext.c	2
/src/gnutls/lib/x509/crl.c	1
/src/gnutls/lib/pcert.c	1
/src/gnutls/lib/pubkey.c	1
/src/gnutls/lib/pk.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/./str_array.h	1
/src/gnutls/lib/privkey.c	1
/src/gnutls/lib/x509/privkey.c	2
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/dh.c	1
/src/gnutls/lib/priority.c	3
/src/gnutls/lib/global.c	2
/src/gnutls/lib/errors.c	1
/src/gnutls/lib/system/keys-dummy.c	1
/src/gnutls/lib/nettle/init.c	1
/src/nettle/mini-gmp.c	5
/src/gnutls/lib/compress.c	1
/src/gnutls/lib/random.c	1
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/nettle/sysrng-linux.c	1
/src/gnutls/lib/hello_ext.c	1
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/system.c	2
/src/gnutls/lib/accelerated/cryptodev.c	1
/src/gnutls/lib/supplemental.c	1
/src/gnutls/lib/./name_val_array.h	1
/src/gnutls/lib/kx.c	1
/src/wget2/libwget/hsts.c	2
/src/wget2/libwget/hpkp_db.c	2
/src/wget2/libwget/tls_session.c	2
/src/wget2/libwget/ocsp.c	2
/src/wget2/libwget/netrc.c	2

Fuzzer: libwget_http_client_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9452	95.7%
gold	[1:9]	124	1.25%
yellow	[10:29]	3	0.03%
greenyellow	[30:49]	3	0.03%
lawngreen	50+	291	2.94%
All colors	9873	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
30674	41022	5 : View List ['wget_tcp_set_ssl_hostname', 'wget_tcp_tls_start', 'wget_tcp_set_ssl', 'establish_proxy_connect', 'wget_http_close']	30674	41059	wget_http_open	call site: 00409	/src/wget2/libwget/http.c:602
20089	40768	12 : View List ['wget_tcp_close', 'tcp_connect', 'debug_addr', 'print_error_host', 'wget_ssl_open', 'set_socket_options', '__errno_location', 'gettext', 'socket', '_set_async', 'bind', 'close']	20089	40792	wget_tcp_connect	call site: 00536	/src/wget2/libwget/net.c:793
10468	10468	1 : View List ['wget_ssl_read_timeout']	10472	10472	wget_tcp_read	call site: 07925	/src/wget2/libwget/net.c:889
10312	10312	1 : View List ['wget_ssl_write_timeout']	10312	10312	wget_tcp_write	call site: 05101	/src/wget2/libwget/net.c:940
725	2055	19 : View List ['check_phe_sha512', 'check_optimized_aes', 'check_fast_pclmul', 'padlock_capability', '_gnutls_log', 'check_phe_partial', 'check_sha', 'capabilities_to_intel_cpuid', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'read_cpuid_vals', 'capabilities_to_zhaoxin_edx', 'check_ssse3', 'check_phe', 'check_avx_movbe', 'check_pclmul', 'gnutls_crypto_single_cipher_register', 'gnutls_crypto_single_digest_register', 'check_padlock']	725	2055	register_x86_padlock_crypto	call site: 00876	/src/gnutls/lib/accelerated/x86/x86-common.c:383
479	479	12 : View List ['fseek', 'ini_ctx_deinit', 'fopen', 'pthread_rwlock_wrlock', 'fclose', '_gnutls_buffer_clear', 'ini_parse_file', 'update_system_wide_priority_string', 'construct_system_wide_priority_string', 'gnutls_strerror', '_name_val_array_clear', 'cfg_apply']	611	611	_gnutls_update_system_priorities	call site: 01024	/src/gnutls/lib/priority.c:2214
163	163	1 : View List ['wget_iri_escape_path']	163	199	wget_iri_get_escaped_resource	call site: 00271	/src/wget2/libwget/iri.c:1184
94	287	4 : View List ['wget_dns_cache_get', 'wget_thread_mutex_lock', 'resolve', 'wget_millisleep']	197	408	wget_dns_resolve	call site: 00428	/src/wget2/libwget/dns.c:385
91	91	1 : View List ['wget_str_to_utf8']	91	91	wget_iri_parse	call site: 00260	/src/wget2/libwget/iri.c:670
73	75	3 : View List ['wget_dns_cache_add', 'freeaddrinfo', 'wget_thread_mutex_unlock']	73	75	wget_dns_resolve	call site: 00462	/src/wget2/libwget/dns.c:442
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00769	/src/gnutls/lib/accelerated/x86/x86-common.c:817
33	32246	11 : View List ['http_connection_is_aborted', 'strchr', 'strncmp', 'strstr', 'get_page', 'wget_decompress', 'rpl_strtoll', 'wget_tcp_read', 'wget_buffer_ensure_capacity', '__errno_location', 'gettext']	33	32257	wget_http_get_response_cb	call site: 08581	/src/wget2/libwget/http.c:932

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

1819

Reachable functions

2004

Percentage of reachable functions covered

9.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_http_client_fuzzer.c	7
/src/wget2/libwget/iri.c	11
/src/wget2/lib/./c-ctype.h	10
/src/wget2/libwget/../include/wget/wget.h	5
/src/wget2/libwget/utils.c	11
/src/wget2/libwget/log.c	5
/src/wget2/libwget/encoding.c	6
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/mem.c	4
/src/libidn2/lib/lookup.c	7
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/gnutls/lib/unistring/unistr/u8-to-u32.c	1
/src/gnutls/lib/unistring/unistr/u8-mbtoucr.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/gnutls/lib/unistring/uninorm/u-normalize-internal.h	2
/src/gnutls/lib/unistring/unistr/u32-mbtouc-unsafe.c	1
/src/gnutls/lib/unistring/unictype/combiningclass.c	1
/src/gnutls/lib/unistring/./array-mergesort.h	3
/src/gnutls/lib/unistring/unistr/u32-uctomb.c	1
/src/gnutls/lib/unistring/unistr/u-cpy.h	1
/src/gnutls/lib/unistring/unistr/u32-to-u8.c	1
/src/gnutls/lib/unistring/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/gnutls/lib/unistring/unictype/categ_test.c	1
/src/gnutls/lib/unistring/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/gnutls/lib/unistring/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/net.c	18
/src/wget2/libwget/http.c	20
/src/wget2/libwget/buffer.c	12
/src/wget2/libwget/strscpy.c	1
/src/wget2/libwget/buffer_printf.c	11
/src/wget2/libwget/vector.c	13
/src/wget2/libwget/http_parse.c	35
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/logger.c	1
/src/wget2/libwget/dns.c	5
/src/wget2/lib/gettime.c	1
/src/wget2/libwget/dns_cache.c	2
/src/wget2/libwget/hashmap.c	10
/src/wget2/libwget/printf.c	4
/src/wget2/lib/nanosleep.c	1
/src/wget2/lib/fcntl.c	3
/src/wget2/libwget/ssl_gnutls.c	24
/src/wget2/libwget/ssl.c	2
/src/gnutls/lib/global.c	4
/src/gnutls/lib/errors.c	4
/src/gnutls/lib/./fips.h	5
/src/gnutls/lib/nettle/init.c	2
/src/nettle/mini-gmp.c	6
/src/gnutls/lib/system/keys-dummy.c	3
/src/gnutls/lib/minitasn1/version.c	1
/src/gnutls/lib/minitasn1/structure.c	12
/src/gnutls/lib/minitasn1/./int.h	3
/src/gnutls/lib/minitasn1/parser_aux.c	20
/src/gnutls/lib/minitasn1/gstr.c	2
/src/gnutls/lib/minitasn1/./parser_aux.h	1
/src/gnutls/lib/minitasn1/./gstr.h	1
/src/gnutls/lib/minitasn1/element.c	6
/src/gnutls/lib/minitasn1/coding.c	15
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/random.c	5
/src/gnutls/lib/nettle/sysrng-linux.c	5
/src/gnutls/gl/./gl_list.h	5
/src/gnutls/lib/hello_ext.c	20
/src/gnutls/lib/system.c	2
/src/gnutls/lib/atfork.c	2
/src/gnutls/lib/accelerated/accelerated.c	1
/src/gnutls/lib/accelerated/x86/x86-common.c	18
/usr/local/lib/clang/15.0.0/include/cpuid.h	3
/src/gnutls/lib/crypto-backend.c	8
/src/gnutls/lib/priority.c	38
/src/gnutls/lib/accelerated/cryptodev.c	1
/src/gnutls/lib/accelerated/afalg.c	1
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/algorithms/mac.c	12
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/algorithms/sign.c	16
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/lib/profiles.c	2
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/cipher_int.c	8
/src/wget2/lib/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/str.c	30
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	17
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/state.c	20
/src/gnutls/lib/cert-session.c	6
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/./gnutls_int.h	5
/src/gnutls/lib/x509/x509.c	57
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509_b64.c	5
/src/nettle/base64-decode.c	4
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/./common.h	2
/src/gnutls/lib/minitasn1/decoding.c	21
/src/gnutls/lib/x509/common.c	35
/src/gnutls/lib/x509/extensions.c	7
/src/gnutls/lib/x509/dn.c	8
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/str-iconv.c	3
/src/gnutls/lib/unistring/unistr/u16-to-u8.c	1
/src/gnutls/lib/unistring/unistr/u16-mbtoucr.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	2
/src/libidn2/lib/free.c	1
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	15
/src/gnutls/gl/./bitrotate.h	1
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/ocsp-api.c	3
/src/gnutls/lib/x509/tls_features.c	5
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	6
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/x509/ocsp.c	26
/src/gnutls/lib/x509/./../algorithms.h	8
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/algorithms/publickey.c	8
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/pubkey.c	23
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/key_decode.c	13
/src/gnutls/lib/mpi.c	14
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/x509/key_encode.c	17
/src/gnutls/lib/./datum.h	2
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/./x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	3
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/attributes.c	1
/src/libidn2/lib/decode.c	2
/src/libunistring/lib/unistr/u-cpy-alloc.h	1
/src/libunistring/lib/unistr/u-strlen.h	1
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	25
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/./algorithms.h	26
/src/gnutls/lib/crypto-api.c	15
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/verify.c	20
/src/gnutls/lib/x509/crl.c	11
/src/gnutls/lib/x509/./ip-in-cidr.h	1
/src/gnutls/lib/x509/supported_exts.gperf	2
/src/gnutls/lib/x509/hostname-verify.c	4
/src/gnutls/lib/x509/email-verify.c	1
/src/wget2/libwget/ocsp.c	10
/src/wget2/libwget/hpkp_db.c	1
/src/wget2/libwget/hashfile.c	5
/src/gnutls/lib/record.c	22
/src/wget2/libwget/io.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/cipher.c	9
/src/nettle/fat-x86_64.c	2
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	3
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/ext/safe_renegotiation.c	4
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/pcert.c	6
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/privkey.c	14
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	4
/src/gnutls/lib/hello_ext_lib.c	3
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	2
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/kx.c	16
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	2
/src/nettle/hmac.c	2
/src/nettle/md5.c	4
/src/nettle/hmac-sha1.c	2
/src/nettle/sha1.c	1
/src/nettle/hmac-sha256.c	2
/src/nettle/sha256.c	2
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/hmac-streebog.c	3
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/ext/ext_master_secret.c	1
/src/gnutls/lib/ext/etm.c	1
/src/gnutls/lib/ext/heartbeat.c	1
/src/wget2/libwget/tls_session.c	6
/src/gnutls/lib/system_override.c	1
/src/gnutls/lib/system/sockets.c	6
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/ext/alpn.c	2
/src/gnutls/lib/srp.c	1
/src/gnutls/lib/psk.c	2
/src/wget2/libwget/hpkp.c	7
/src/wget2/libwget/base64.c	4
/src/wget2/libwget/stringmap.c	2
/src/wget2/libwget/cookie_parse.c	4
/src/wget2/libwget/decompressor.c	10
/src/wget2/lib/./strtol.c	1
/src/gnutls/lib/cert-cred-x509.c	16
/src/gnutls/lib/system/certs.c	2
/src/gnutls/lib/x509/verify-high2.c	2
/src/gnutls/gl/read-file.c	2
/src/gnutls/gl/memset_explicit.c	1
/src/gnutls/lib/urls.c	3
/src/gnutls/lib/x509/privkey_pkcs8.c	12
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	3
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/gnutls/lib/unistring/unistr/u8-to-u16.c	1
/src/gnutls/lib/unistring/unistr/u16-uctomb.c	1
/src/gnutls/lib/unistring/unistr/u16-mbtouc-unsafe.c	1
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/str-unicode.c	3
/src/gnutls/lib/unistring/unistr/u8-check.c	1
/src/gnutls/lib/unistring/unictype/categ_or.c	1
/src/gnutls/lib/unistring/unictype/categ_and_not.c	1
/src/gnutls/lib/unistring/unictype/pr_default_ignorable_code_point.c	1
/src/gnutls/lib/unistring/unictype/pr_not_a_character.c	1
/src/gnutls/lib/unistring/unictype/pr_join_control.c	1
/src/nettle/write-le32.c	1
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/priority_options.gperf	2