High level conclusions

Fuzzers reach 88.27% of cyclomatic complexity.

Fuzzers reach 83.63% of all functions.

Fuzzers reach 84.24% code coverage.

Reachability and coverage overview

Functions statically reachable by fuzzers

138 / 165

Cyclomatic complexity statically reachable by fuzzers

1400 / 1586

Runtime code coverage of functions

139 / 165

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: zlib_uncompress3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	52.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	11	inflate	call site: 00011	crc32
9	28	adler32	call site: 00028	crc32

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

5

Reachable functions

21

Percentage of reachable functions covered

76.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
zlib_uncompress3_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: example_dict_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	35.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	109	64.4%
All colors	169	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	51	deflate	call site: 00051	crc32
13	8	deflateResetKeep	call site: 00008	crc32_z
8	137	inflate	call site: 00137	crc32
6	109	deflate_rle	call site: 00109	_tr_flush_block
5	69	_tr_stored_block	call site: 00069	read_buf
3	154	inflate	call site: 00154	crc32
2	101	deflate_huff	call site: 00101	_tr_flush_block
2	134	inflate	call site: 00134	crc32
1	2	test_dict_deflate	call site: 00002	deflateEnd
1	35	read_buf	call site: 00035	crc32
1	43	deflate	call site: 00043	flush_pending
1	67	deflate	call site: 00067	_tr_stored_block

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

10

Reachable functions

63

Percentage of reachable functions covered

84.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_dict_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	11
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: example_large_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	40.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	99	59.2%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	41	deflate	call site: 00041	crc32
13	11	deflateResetKeep	call site: 00011	crc32_z
10	98	deflate	call site: 00098	_tr_flush_block
9	142	inflate	call site: 00142	crc32
5	92	_tr_flush_block	call site: 00092	_tr_flush_block
2	37	deflate	call site: 00037	putShortMSB
2	64	deflate_stored	call site: 00064	flush_pending
2	139	inflate	call site: 00139	crc32
1	5	deflateInit_	call site: 00005	deflateEnd
1	33	deflate	call site: 00033	flush_pending
1	60	deflate_stored	call site: 00060	read_buf
1	62	read_buf	call site: 00062	crc32

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

10

Reachable functions

61

Percentage of reachable functions covered

83.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_large_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: checksum_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	85.1%
All colors	47	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	7	crc32_z	call site: 00007	byte_swap

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

3

Reachable functions

18

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
checksum_fuzzer.c	1
zlib/crc32.c	12
zlib/adler32.c	4

Fuzzer: example_small_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	71	44.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	88	55.3%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
13	12	deflateResetKeep	call site: 00012	crc32_z
11	99	deflate	call site: 00099	_tr_flush_block
9	133	inflate	call site: 00133	crc32
5	93	_tr_flush_block	call site: 00093	_tr_flush_block
4	63	read_buf	call site: 00063	read_buf
3	146	inflate	call site: 00146	inflate_fast
2	38	deflate	call site: 00038	putShortMSB
2	60	_tr_stored_block	call site: 00060	read_buf
2	130	inflate	call site: 00130	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	58	deflate	call site: 00058	_tr_stored_block

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

13

Reachable functions

62

Percentage of reachable functions covered

79.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_small_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codezlib_uncompress_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	39.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	31	60.7%
All colors	51	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	crc32_z	call site: 00019	crc32
8	29	adler32	call site: 00029	crc32
2	46	inflate	call site: 00046	crc32
1	0	EP	call site: 00000	uncompress
1	12	inflate	call site: 00012	crc32

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

2

Reachable functions

22

Percentage of reachable functions covered

90.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codezlib_uncompress_fuzzer.cc	1
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codechecksum_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	65.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	16	34.0%
All colors	47	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	32	crc32_combine64	call site: 00032	adler32
8	7	crc32_z	call site: 00007	adler32
6	23	crc32_combine_op	call site: 00023	crc32
2	20	x2nmodp	call site: 00020	crc32_z
1	0	EP	call site: 00000	crc32
1	16	adler32	call site: 00016	crc32_combine_gen
1	45	adler32_combine	call site: 00045	__assert_fail

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

3

Reachable functions

18

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codechecksum_fuzzer.c	1
zlib/crc32.c	12
zlib/adler32.c	4

Fuzzer: inspector/light/source_filesexample_flush_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	33.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	110	66.6%
All colors	165	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
6	104	deflate_rle	call site: 00104	_tr_flush_block
4	0	EP	call site: 00000	test_flush
4	63	read_buf	call site: 00063	read_buf
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	115	test_flush	call site: 00115	fprintf

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

5

Reachable functions

63

Percentage of reachable functions covered

92.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_flush_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	12
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeexample_small_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	33.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	105	66.0%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
6	104	deflate_rle	call site: 00104	_tr_flush_block
4	0	EP	call site: 00000	test_deflate
4	63	read_buf	call site: 00063	read_buf
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	118	test_deflate	call site: 00118	test_inflate

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

6

Reachable functions

62

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_small_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_fileszlib_uncompress_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	39.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	31	60.7%
All colors	51	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	crc32_z	call site: 00019	crc32
8	29	adler32	call site: 00029	crc32
2	46	inflate	call site: 00046	crc32
1	0	EP	call site: 00000	uncompress
1	12	inflate	call site: 00012	crc32

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

2

Reachable functions

22

Percentage of reachable functions covered

90.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileszlib_uncompress_fuzzer.cc	1
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filesgzio_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	42.7%
gold	[1:9]	13	4.59%
yellow	[10:29]	7	2.47%
greenyellow	[30:49]	2	0.70%
lawngreen	50+	140	49.4%
All colors	283	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	66	deflate	call site: 00066	crc32
8	182	inflate	call site: 00182	crc32
7	33	crc32_z	call site: 00033	byte_swap
6	46	deflateReset	call site: 00046	deflateReset
6	128	deflate_rle	call site: 00128	_tr_flush_block
6	241	gzvprintf	call site: 00241	gzprintf
5	199	inflate	call site: 00199	crc32
5	267	gzclose_r	call site: 00267	gzclose
4	11	gz_reset	call site: 00011	gzputc
4	87	read_buf	call site: 00087	read_buf
3	0	EP	call site: 00000	gzopen
3	53	gz_comp	call site: 00053	gz_error

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

16

Reachable functions

115

Percentage of reachable functions covered

86.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesgzio_fuzzer.c	1
zlib/gzlib.c	15
zlib/gzwrite.c	12
zlib/deflate.c	16
zlib/crc32.c	6
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzread.c	15
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1
zlib/zutil.c	3
zlib/gzclose.c	1

Fuzzer: inspector/light/source_fileszlib_uncompress2_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileszlib_uncompress2_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: example_flush_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	73	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	92	55.7%
All colors	165	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
13	12	deflateResetKeep	call site: 00012	crc32_z
9	99	deflate	call site: 00099	_tr_flush_block
9	133	inflate	call site: 00133	crc32
5	93	_tr_flush_block	call site: 00093	_tr_flush_block
5	147	inflate	call site: 00147	crc32
4	63	read_buf	call site: 00063	read_buf
2	38	deflate	call site: 00038	putShortMSB
2	60	_tr_stored_block	call site: 00060	read_buf
2	130	inflate	call site: 00130	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

12

Reachable functions

63

Percentage of reachable functions covered

80.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_flush_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	12
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_fileszlib_uncompress3_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileszlib_uncompress3_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_fileschecksum_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	65.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	16	34.0%
All colors	47	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	32	crc32_combine64	call site: 00032	adler32
8	7	crc32_z	call site: 00007	adler32
6	23	crc32_combine_op	call site: 00023	crc32
2	20	x2nmodp	call site: 00020	crc32_z
1	0	EP	call site: 00000	crc32
1	16	adler32	call site: 00016	crc32_combine_gen
1	45	adler32_combine	call site: 00045	__assert_fail

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

3

Reachable functions

18

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileschecksum_fuzzer.c	1
zlib/crc32.c	12
zlib/adler32.c	4

Fuzzer: gzio_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	95	33.5%
gold	[1:9]	24	8.48%
yellow	[10:29]	20	7.06%
greenyellow	[30:49]	16	5.65%
lawngreen	50+	128	45.2%
All colors	283	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
34	170	gz_load	call site: 00170	gz_decomp
13	68	deflate	call site: 00068	crc32
7	33	crc32_z	call site: 00033	byte_swap
5	61	_tr_flush_bits	call site: 00061	adler32
4	48	gz_comp	call site: 00048	deflateReset
3	11	gz_reset	call site: 00011	strlen
3	53	gz_comp	call site: 00053	gz_error
3	130	deflate_rle	call site: 00130	_tr_align
3	209	gzseek	call site: 00209	gzrewind
2	18	gz_comp	call site: 00018	gz_error
2	134	deflate	call site: 00134	putShortMSB
2	205	gz_read	call site: 00205	gz_decomp

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

26

Reachable functions

115

Percentage of reachable functions covered

77.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gzio_fuzzer.c	1
zlib/gzlib.c	15
zlib/gzwrite.c	12
zlib/deflate.c	16
zlib/crc32.c	6
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzread.c	15
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1
zlib/zutil.c	3
zlib/gzclose.c	1

Fuzzer: minigzip_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	38.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	161	61.2%
All colors	263	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	87	deflate	call site: 00087	crc32
8	147	deflate_rle	call site: 00147	_tr_flush_block
8	218	inflate	call site: 00218	crc32
7	49	crc32_z	call site: 00049	byte_swap
5	66	gz_comp	call site: 00066	deflateReset
5	80	_tr_flush_bits	call site: 00080	adler32
4	22	gz_reset	call site: 00022	strlen
3	62	deflateReset	call site: 00062	gz_zero
3	72	gz_comp	call site: 00072	gz_error
3	103	_tr_stored_block	call site: 00103	read_buf
3	107	read_buf	call site: 00107	read_buf
3	238	inflate	call site: 00238	gz_error

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

31

Reachable functions

100

Percentage of reachable functions covered

69.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
minigzip_fuzzer.c	6
zlib/gzlib.c	5
zlib/gzwrite.c	6
zlib/deflate.c	15
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzclose.c	1
zlib/gzread.c	9
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: zlib_uncompress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	47.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	52.9%
All colors	51	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	12	inflate	call site: 00012	crc32
9	29	adler32	call site: 00029	crc32

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

5

Reachable functions

22

Percentage of reachable functions covered

77.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
zlib_uncompress_fuzzer.cc	1
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filesexample_large_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	32.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	67.0%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	41	deflate	call site: 00041	crc32
8	142	inflate	call site: 00142	crc32
7	17	crc32_z	call site: 00017	byte_swap
6	103	deflate_rle	call site: 00103	_tr_flush_block
4	62	read_buf	call site: 00062	read_buf
3	0	EP	call site: 00000	test_large_deflate
2	95	deflate_huff	call site: 00095	_tr_flush_block
2	139	inflate	call site: 00139	crc32
2	159	inflate	call site: 00159	crc32
1	5	deflateInit_	call site: 00005	deflateEnd
1	33	deflate	call site: 00033	flush_pending
1	113	test_large_deflate	call site: 00113	fprintf

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

5

Reachable functions

61

Percentage of reachable functions covered

91.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_large_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: zlib_uncompress2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	4.0%
lawngreen	50+	24	48.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	11	inflate	call site: 00011	crc32
9	28	adler32	call site: 00028	crc32

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

5

Reachable functions

21

Percentage of reachable functions covered

76.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
zlib_uncompress2_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: compress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	65	41.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	92	58.5%
All colors	157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
13	13	deflateResetKeep	call site: 00013	crc32_z
11	99	deflate	call site: 00099	_tr_flush_block
9	129	inflate	call site: 00129	crc32
5	93	_tr_flush_block	call site: 00093	_tr_flush_block
4	63	read_buf	call site: 00063	read_buf
2	38	deflate	call site: 00038	putShortMSB
2	126	inflate	call site: 00126	crc32
1	7	deflateInit_	call site: 00007	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	68	deflate	call site: 00068	fill_window
1	71	fill_window	call site: 00071	_tr_flush_block

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

11

Reachable functions

66

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
compress_fuzzer.c	4
zlib/compress.c	2
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codezlib_uncompress3_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codezlib_uncompress3_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filesexample_dict_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	51	30.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	118	69.8%
All colors	169	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	51	deflate	call site: 00051	crc32
8	137	inflate	call site: 00137	crc32
7	14	crc32_z	call site: 00014	byte_swap
6	109	deflate_rle	call site: 00109	_tr_flush_block
3	71	deflate_stored	call site: 00071	read_buf
3	154	inflate	call site: 00154	crc32
2	101	deflate_huff	call site: 00101	_tr_flush_block
2	134	inflate	call site: 00134	crc32
1	2	test_dict_deflate	call site: 00002	deflateEnd
1	35	read_buf	call site: 00035	crc32
1	43	deflate	call site: 00043	flush_pending
1	118	deflate	call site: 00118	fprintf

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

6

Reachable functions

63

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_dict_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	11
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filesexample_small_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	33.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	105	66.0%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
6	104	deflate_rle	call site: 00104	_tr_flush_block
4	0	EP	call site: 00000	test_deflate
4	63	read_buf	call site: 00063	read_buf
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	118	test_deflate	call site: 00118	test_inflate

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

6

Reachable functions

62

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_small_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codecompress_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	53	33.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	66.2%
All colors	157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	129	inflate	call site: 00129	crc32
7	19	crc32_z	call site: 00019	byte_swap
6	104	deflate_rle	call site: 00104	_tr_flush_block
4	0	EP	call site: 00000	check_compress_level
4	63	read_buf	call site: 00063	read_buf
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	126	inflate	call site: 00126	crc32
2	146	inflate	call site: 00146	crc32
1	7	deflateInit_	call site: 00007	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	153	check_compress_level	call site: 00153	check_decompress

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

6

Reachable functions

66

Percentage of reachable functions covered

90.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codecompress_fuzzer.c	4
zlib/compress.c	2
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codezlib_uncompress2_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codezlib_uncompress2_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeexample_flush_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	33.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	110	66.6%
All colors	165	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
6	104	deflate_rle	call site: 00104	_tr_flush_block
4	0	EP	call site: 00000	test_flush
4	63	read_buf	call site: 00063	read_buf
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	115	test_flush	call site: 00115	fprintf

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

5

Reachable functions

63

Percentage of reachable functions covered

92.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_flush_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	12
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filescompress_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	53	33.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	66.2%
All colors	157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	129	inflate	call site: 00129	crc32
7	19	crc32_z	call site: 00019	byte_swap
6	104	deflate_rle	call site: 00104	_tr_flush_block
4	0	EP	call site: 00000	check_compress_level
4	63	read_buf	call site: 00063	read_buf
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	126	inflate	call site: 00126	crc32
2	146	inflate	call site: 00146	crc32
1	7	deflateInit_	call site: 00007	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	153	check_compress_level	call site: 00153	check_decompress

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

6

Reachable functions

66

Percentage of reachable functions covered

90.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filescompress_fuzzer.c	4
zlib/compress.c	2
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeexample_large_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	32.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	67.0%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	41	deflate	call site: 00041	crc32
8	142	inflate	call site: 00142	crc32
7	17	crc32_z	call site: 00017	byte_swap
6	103	deflate_rle	call site: 00103	_tr_flush_block
4	62	read_buf	call site: 00062	read_buf
3	0	EP	call site: 00000	test_large_deflate
2	95	deflate_huff	call site: 00095	_tr_flush_block
2	139	inflate	call site: 00139	crc32
2	159	inflate	call site: 00159	crc32
1	5	deflateInit_	call site: 00005	deflateEnd
1	33	deflate	call site: 00033	flush_pending
1	113	test_large_deflate	call site: 00113	fprintf

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

5

Reachable functions

61

Percentage of reachable functions covered

91.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_large_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeexample_dict_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	51	30.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	118	69.8%
All colors	169	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	51	deflate	call site: 00051	crc32
8	137	inflate	call site: 00137	crc32
7	14	crc32_z	call site: 00014	byte_swap
6	109	deflate_rle	call site: 00109	_tr_flush_block
3	71	deflate_stored	call site: 00071	read_buf
3	154	inflate	call site: 00154	crc32
2	101	deflate_huff	call site: 00101	_tr_flush_block
2	134	inflate	call site: 00134	crc32
1	2	test_dict_deflate	call site: 00002	deflateEnd
1	35	read_buf	call site: 00035	crc32
1	43	deflate	call site: 00043	flush_pending
1	118	deflate	call site: 00118	fprintf

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

6

Reachable functions

63

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_dict_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	11
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codegzio_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	42.7%
gold	[1:9]	13	4.59%
yellow	[10:29]	7	2.47%
greenyellow	[30:49]	2	0.70%
lawngreen	50+	140	49.4%
All colors	283	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	66	deflate	call site: 00066	crc32
8	182	inflate	call site: 00182	crc32
7	33	crc32_z	call site: 00033	byte_swap
6	46	deflateReset	call site: 00046	deflateReset
6	128	deflate_rle	call site: 00128	_tr_flush_block
6	241	gzvprintf	call site: 00241	gzprintf
5	199	inflate	call site: 00199	crc32
5	267	gzclose_r	call site: 00267	gzclose
4	11	gz_reset	call site: 00011	gzputc
4	87	read_buf	call site: 00087	read_buf
3	0	EP	call site: 00000	gzopen
3	53	gz_comp	call site: 00053	gz_error

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

16

Reachable functions

115

Percentage of reachable functions covered

86.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codegzio_fuzzer.c	1
zlib/gzlib.c	15
zlib/gzwrite.c	12
zlib/deflate.c	16
zlib/crc32.c	6
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzread.c	15
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1
zlib/zutil.c	3
zlib/gzclose.c	1

Fuzzer: inspector/light/source_filesminigzip_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	40.3%
gold	[1:9]	1	0.38%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	156	59.3%
All colors	263	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	85	deflate	call site: 00085	crc32
9	253	file_uncompress	call site: 00253	error
8	0	EP	call site: 00000	file_compress
8	219	inflate	call site: 00219	crc32
7	49	crc32_z	call site: 00049	byte_swap
6	147	deflate_rle	call site: 00147	_tr_flush_block
5	66	gz_comp	call site: 00066	deflateReset
5	236	inflate	call site: 00236	crc32
4	22	gz_reset	call site: 00022	strlen
4	106	read_buf	call site: 00106	read_buf
3	72	gz_comp	call site: 00072	gz_error
2	34	gz_write	call site: 00034	gz_error

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

24

Reachable functions

100

Percentage of reachable functions covered

76.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesminigzip_fuzzer.c	6
zlib/gzlib.c	5
zlib/gzwrite.c	6
zlib/deflate.c	15
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzclose.c	1
zlib/gzread.c	9
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeminigzip_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	40.3%
gold	[1:9]	1	0.38%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	156	59.3%
All colors	263	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	85	deflate	call site: 00085	crc32
9	253	file_uncompress	call site: 00253	error
8	0	EP	call site: 00000	file_compress
8	219	inflate	call site: 00219	crc32
7	49	crc32_z	call site: 00049	byte_swap
6	147	deflate_rle	call site: 00147	_tr_flush_block
5	66	gz_comp	call site: 00066	deflateReset
5	236	inflate	call site: 00236	crc32
4	22	gz_reset	call site: 00022	strlen
4	106	read_buf	call site: 00106	read_buf
3	72	gz_comp	call site: 00072	gz_error
2	34	gz_write	call site: 00034	gz_error

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

24

Reachable functions

100

Percentage of reachable functions covered

76.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeminigzip_fuzzer.c	6
zlib/gzlib.c	5
zlib/gzwrite.c	6
zlib/deflate.c	15
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzclose.c	1
zlib/gzread.c	9
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
deflate_slow	/src/zlib/deflate.c	2	['N/A', 'int']	5	0	1013	92	34	29	0	255	56

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

140 / 165

Cyclomatic complexity statically reachable by fuzzers

1456 / 1586

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

zlib_uncompress3_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['inflate', 'adler32']

example_dict_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', 'deflate_rle', '_tr_stored_block', 'deflate_huff', 'test_dict_deflate', 'read_buf']

example_large_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'deflate_stored', 'deflateInit_']

checksum_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z']

example_small_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'read_buf', '_tr_stored_block']

inspector/source-codezlib_uncompress_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/source-codechecksum_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_combine64', 'crc32_z', 'crc32_combine_op', 'x2nmodp', 'adler32', 'adler32_combine']

inspector/light/source_filesexample_flush_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

inspector/source-codeexample_small_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

inspector/light/source_fileszlib_uncompress_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/light/source_filesgzio_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflateReset', 'deflate_rle', 'gzvprintf', 'gzclose_r', 'gz_reset', 'read_buf']

inspector/light/source_fileszlib_uncompress2_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

example_flush_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'read_buf', '_tr_stored_block']

inspector/light/source_fileszlib_uncompress3_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/light/source_fileschecksum_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_combine64', 'crc32_z', 'crc32_combine_op', 'x2nmodp', 'adler32', 'adler32_combine']

gzio_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['gz_load', 'deflate', 'crc32_z', '_tr_flush_bits', 'gz_comp', 'gz_reset', 'deflate_rle', 'gzseek']

minigzip_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflate_rle', 'inflate', 'crc32_z', 'gz_comp', '_tr_flush_bits', 'gz_reset', 'deflateReset', '_tr_stored_block']

zlib_uncompress_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['inflate', 'adler32']

inspector/light/source_filesexample_large_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

zlib_uncompress2_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['inflate', 'adler32']

compress_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'read_buf', 'deflateInit_']

inspector/source-codezlib_uncompress3_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/light/source_filesexample_dict_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'deflate_stored', 'deflate_huff', 'test_dict_deflate', 'read_buf']

inspector/light/source_filesexample_small_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

inspector/source-codecompress_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

inspector/source-codezlib_uncompress2_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/source-codeexample_flush_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

inspector/light/source_filescompress_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

inspector/source-codeexample_large_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'read_buf', 'deflate_huff', 'deflateInit_']

inspector/source-codeexample_dict_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_rle', 'deflate_stored', 'deflate_huff', 'test_dict_deflate', 'read_buf']

inspector/source-codegzio_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflateReset', 'deflate_rle', 'gzvprintf', 'gzclose_r', 'gz_reset', 'read_buf']

inspector/light/source_filesminigzip_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'file_uncompress', 'inflate', 'crc32_z', 'deflate_rle', 'gz_comp', 'gz_reset', 'read_buf']

inspector/source-codeminigzip_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'file_uncompress', 'inflate', 'crc32_z', 'deflate_rle', 'gz_comp', 'gz_reset', 'read_buf']