High level conclusions

Fuzzers reach 88.59% of cyclomatic complexity.

Fuzzers reach 83.73% of all functions.

Fuzzers reach 85.54% code coverage.

Reachability and coverage overview

Functions statically reachable by fuzzers

139 / 166

Cyclomatic complexity statically reachable by fuzzers

1445 / 1631

Runtime code coverage of functions

142 / 166

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: checksum_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	85.1%
All colors	47	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	7	crc32_z	call site: 00007	byte_swap

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

3

Reachable functions

18

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
checksum_fuzzer.c	1
zlib/crc32.c	12
zlib/adler32.c	4

Fuzzer: zlib_uncompress3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	52.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	11	inflate	call site: 00011	crc32
9	28	adler32	call site: 00028	crc32

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

5

Reachable functions

21

Percentage of reachable functions covered

76.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
zlib_uncompress3_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: example_flush_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	73	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	92	55.7%
All colors	165	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
13	12	deflateResetKeep	call site: 00012	crc32_z
9	99	deflate	call site: 00099	_tr_flush_block
9	133	inflate	call site: 00133	crc32
5	93	_tr_flush_block	call site: 00093	_tr_flush_block
5	147	inflate	call site: 00147	crc32
4	63	read_buf	call site: 00063	read_buf
2	38	deflate	call site: 00038	putShortMSB
2	60	_tr_stored_block	call site: 00060	read_buf
2	130	inflate	call site: 00130	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

12

Reachable functions

63

Percentage of reachable functions covered

80.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_flush_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	12
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: minigzip_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	37.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	1.81%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	167	60.5%
All colors	276	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	94	deflate	call site: 00094	crc32
8	154	deflate_rle	call site: 00154	_tr_flush_block
8	228	inflate	call site: 00228	crc32
7	52	crc32_z	call site: 00052	byte_swap
7	69	gz_comp	call site: 00069	deflateReset
5	87	_tr_flush_bits	call site: 00087	adler32
4	78	gz_comp	call site: 00078	gz_error
3	18	gz_open	call site: 00018	fcntl
3	110	_tr_stored_block	call site: 00110	read_buf
3	114	read_buf	call site: 00114	read_buf
3	163	deflate	call site: 00163	gz_comp
3	216	gz_load	call site: 00216	__errno_location

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

31

Reachable functions

101

Percentage of reachable functions covered

69.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
minigzip_fuzzer.c	6
zlib/gzlib.c	5
zlib/gzwrite.c	6
zlib/deflate.c	15
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzclose.c	1
zlib/gzread.c	9
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: example_large_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	40.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	99	59.2%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	41	deflate	call site: 00041	crc32
13	11	deflateResetKeep	call site: 00011	crc32_z
10	98	deflate	call site: 00098	_tr_flush_block
9	142	inflate	call site: 00142	crc32
5	92	_tr_flush_block	call site: 00092	_tr_flush_block
2	37	deflate	call site: 00037	putShortMSB
2	64	deflate_stored	call site: 00064	flush_pending
2	139	inflate	call site: 00139	crc32
1	5	deflateInit_	call site: 00005	deflateEnd
1	33	deflate	call site: 00033	flush_pending
1	60	deflate_stored	call site: 00060	read_buf
1	62	read_buf	call site: 00062	crc32

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

10

Reachable functions

61

Percentage of reachable functions covered

83.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_large_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_fileszlib_uncompress2_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileszlib_uncompress2_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codechecksum_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	65.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	16	34.0%
All colors	47	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	32	crc32_combine64	call site: 00032	adler32
8	7	crc32_z	call site: 00007	adler32
6	23	crc32_combine_op	call site: 00023	crc32
2	20	x2nmodp	call site: 00020	crc32_z
1	0	EP	call site: 00000	crc32
1	16	adler32	call site: 00016	crc32_combine_gen
1	45	adler32_combine	call site: 00045	__assert_fail

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

3

Reachable functions

18

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codechecksum_fuzzer.c	1
zlib/crc32.c	12
zlib/adler32.c	4

Fuzzer: inspector/light/source_filesexample_flush_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	32.7%
gold	[1:9]	1	0.60%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	110	66.6%
All colors	165	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
4	0	EP	call site: 00000	test_flush
4	63	read_buf	call site: 00063	read_buf
3	104	deflate_rle	call site: 00104	_tr_flush_block
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	108	_tr_align	call site: 00108	flush_pending
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

4

Reachable functions

63

Percentage of reachable functions covered

93.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_flush_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	12
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codezlib_uncompress3_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codezlib_uncompress3_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_fileszlib_uncompress_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	39.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	31	60.7%
All colors	51	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	crc32_z	call site: 00019	crc32
8	29	adler32	call site: 00029	crc32
2	46	inflate	call site: 00046	crc32
1	0	EP	call site: 00000	uncompress
1	12	inflate	call site: 00012	crc32

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

2

Reachable functions

22

Percentage of reachable functions covered

90.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileszlib_uncompress_fuzzer.cc	1
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeexample_flush_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	32.7%
gold	[1:9]	1	0.60%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	110	66.6%
All colors	165	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
4	0	EP	call site: 00000	test_flush
4	63	read_buf	call site: 00063	read_buf
3	104	deflate_rle	call site: 00104	_tr_flush_block
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	108	_tr_align	call site: 00108	flush_pending
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

4

Reachable functions

63

Percentage of reachable functions covered

93.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_flush_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	12
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_fileszlib_uncompress3_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileszlib_uncompress3_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeexample_small_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	53	33.3%
gold	[1:9]	1	0.62%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	105	66.0%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
4	0	EP	call site: 00000	test_deflate
4	63	read_buf	call site: 00063	read_buf
3	104	deflate_rle	call site: 00104	_tr_flush_block
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	108	_tr_align	call site: 00108	flush_pending
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

5

Reachable functions

62

Percentage of reachable functions covered

91.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_small_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: compress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	65	41.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	92	58.5%
All colors	157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
13	13	deflateResetKeep	call site: 00013	crc32_z
11	99	deflate	call site: 00099	_tr_flush_block
9	129	inflate	call site: 00129	crc32
5	93	_tr_flush_block	call site: 00093	_tr_flush_block
4	63	read_buf	call site: 00063	read_buf
2	38	deflate	call site: 00038	putShortMSB
2	126	inflate	call site: 00126	crc32
1	7	deflateInit_	call site: 00007	deflateEnd
1	34	deflate	call site: 00034	flush_pending
1	68	deflate	call site: 00068	fill_window
1	71	fill_window	call site: 00071	_tr_flush_block

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

11

Reachable functions

66

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
compress_fuzzer.c	4
zlib/compress.c	2
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: example_dict_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	35.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	109	64.4%
All colors	169	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	51	deflate	call site: 00051	crc32
13	8	deflateResetKeep	call site: 00008	crc32_z
8	137	inflate	call site: 00137	crc32
6	109	deflate_rle	call site: 00109	_tr_flush_block
5	69	_tr_stored_block	call site: 00069	read_buf
3	154	inflate	call site: 00154	crc32
2	101	deflate_huff	call site: 00101	_tr_flush_block
2	134	inflate	call site: 00134	crc32
1	2	test_dict_deflate	call site: 00002	deflateEnd
1	35	read_buf	call site: 00035	crc32
1	43	deflate	call site: 00043	flush_pending
1	67	deflate	call site: 00067	_tr_stored_block

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

10

Reachable functions

63

Percentage of reachable functions covered

84.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_dict_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	11
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codezlib_uncompress2_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	40.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	60.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	crc32_z	call site: 00018	crc32
8	28	adler32	call site: 00028	crc32
2	45	inflate	call site: 00045	crc32
1	0	EP	call site: 00000	uncompress2
1	11	inflate	call site: 00011	crc32

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

2

Reachable functions

21

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codezlib_uncompress2_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filescompress_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	52	33.1%
gold	[1:9]	1	0.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	66.2%
All colors	157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	129	inflate	call site: 00129	crc32
7	19	crc32_z	call site: 00019	byte_swap
4	0	EP	call site: 00000	check_compress_level
4	63	read_buf	call site: 00063	read_buf
3	104	deflate_rle	call site: 00104	_tr_flush_block
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	108	_tr_align	call site: 00108	flush_pending
2	126	inflate	call site: 00126	crc32
2	146	inflate	call site: 00146	crc32
1	7	deflateInit_	call site: 00007	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

5

Reachable functions

66

Percentage of reachable functions covered

92.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filescompress_fuzzer.c	4
zlib/compress.c	2
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: example_small_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	71	44.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	88	55.3%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
13	12	deflateResetKeep	call site: 00012	crc32_z
11	99	deflate	call site: 00099	_tr_flush_block
9	133	inflate	call site: 00133	crc32
5	93	_tr_flush_block	call site: 00093	_tr_flush_block
4	63	read_buf	call site: 00063	read_buf
3	146	inflate	call site: 00146	inflate_fast
2	38	deflate	call site: 00038	putShortMSB
2	60	_tr_stored_block	call site: 00060	read_buf
2	130	inflate	call site: 00130	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	58	deflate	call site: 00058	_tr_stored_block

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

13

Reachable functions

62

Percentage of reachable functions covered

79.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
example_small_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: zlib_uncompress2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	52.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	11	inflate	call site: 00011	crc32
9	28	adler32	call site: 00028	crc32

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

5

Reachable functions

21

Percentage of reachable functions covered

76.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
zlib_uncompress2_fuzzer.cc	1
zlib/uncompr.c	1
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codezlib_uncompress_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	39.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	31	60.7%
All colors	51	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	crc32_z	call site: 00019	crc32
8	29	adler32	call site: 00029	crc32
2	46	inflate	call site: 00046	crc32
1	0	EP	call site: 00000	uncompress
1	12	inflate	call site: 00012	crc32

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

2

Reachable functions

22

Percentage of reachable functions covered

90.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codezlib_uncompress_fuzzer.cc	1
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeexample_large_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	32.3%
gold	[1:9]	1	0.59%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	67.0%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	41	deflate	call site: 00041	crc32
8	142	inflate	call site: 00142	crc32
7	17	crc32_z	call site: 00017	byte_swap
4	62	read_buf	call site: 00062	read_buf
3	0	EP	call site: 00000	test_large_deflate
3	103	deflate_rle	call site: 00103	_tr_flush_block
2	95	deflate_huff	call site: 00095	_tr_flush_block
2	107	_tr_align	call site: 00107	flush_pending
2	139	inflate	call site: 00139	crc32
2	159	inflate	call site: 00159	crc32
1	5	deflateInit_	call site: 00005	deflateEnd
1	33	deflate	call site: 00033	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

4

Reachable functions

61

Percentage of reachable functions covered

93.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_large_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_fileschecksum_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	65.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	16	34.0%
All colors	47	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	32	crc32_combine64	call site: 00032	adler32
8	7	crc32_z	call site: 00007	adler32
6	23	crc32_combine_op	call site: 00023	crc32
2	20	x2nmodp	call site: 00020	crc32_z
1	0	EP	call site: 00000	crc32
1	16	adler32	call site: 00016	crc32_combine_gen
1	45	adler32_combine	call site: 00045	__assert_fail

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

3

Reachable functions

18

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_fileschecksum_fuzzer.c	1
zlib/crc32.c	12
zlib/adler32.c	4

Fuzzer: inspector/source-codeexample_dict_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	50	29.5%
gold	[1:9]	1	0.59%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	118	69.8%
All colors	169	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	51	deflate	call site: 00051	crc32
8	137	inflate	call site: 00137	crc32
7	14	crc32_z	call site: 00014	byte_swap
3	71	deflate_stored	call site: 00071	read_buf
3	109	deflate_rle	call site: 00109	_tr_flush_block
3	154	inflate	call site: 00154	crc32
2	101	deflate_huff	call site: 00101	_tr_flush_block
2	113	_tr_align	call site: 00113	flush_pending
2	134	inflate	call site: 00134	crc32
1	2	test_dict_deflate	call site: 00002	deflateEnd
1	35	read_buf	call site: 00035	crc32
1	43	deflate	call site: 00043	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

5

Reachable functions

63

Percentage of reachable functions covered

92.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeexample_dict_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	11
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codeminigzip_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	38.7%
gold	[1:9]	1	0.36%
yellow	[10:29]	6	2.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	162	58.6%
All colors	276	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	92	deflate	call site: 00092	crc32
9	266	file_uncompress	call site: 00266	error
8	0	EP	call site: 00000	file_compress
8	229	inflate	call site: 00229	crc32
7	52	crc32_z	call site: 00052	byte_swap
7	69	gz_comp	call site: 00069	deflateReset
5	246	inflate	call site: 00246	crc32
4	78	gz_comp	call site: 00078	gz_error
4	113	read_buf	call site: 00113	read_buf
3	18	gz_open	call site: 00018	fcntl
3	154	deflate_rle	call site: 00154	_tr_flush_block
3	216	gz_load	call site: 00216	__errno_location

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

23

Reachable functions

101

Percentage of reachable functions covered

77.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codeminigzip_fuzzer.c	6
zlib/gzlib.c	5
zlib/gzwrite.c	6
zlib/deflate.c	15
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzclose.c	1
zlib/gzread.c	9
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: zlib_uncompress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	47.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	52.9%
All colors	51	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	12	inflate	call site: 00012	crc32
9	29	adler32	call site: 00029	crc32

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

5

Reachable functions

22

Percentage of reachable functions covered

77.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
zlib_uncompress_fuzzer.cc	1
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filesexample_dict_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	50	29.5%
gold	[1:9]	1	0.59%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	118	69.8%
All colors	169	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	51	deflate	call site: 00051	crc32
8	137	inflate	call site: 00137	crc32
7	14	crc32_z	call site: 00014	byte_swap
3	71	deflate_stored	call site: 00071	read_buf
3	109	deflate_rle	call site: 00109	_tr_flush_block
3	154	inflate	call site: 00154	crc32
2	101	deflate_huff	call site: 00101	_tr_flush_block
2	113	_tr_align	call site: 00113	flush_pending
2	134	inflate	call site: 00134	crc32
1	2	test_dict_deflate	call site: 00002	deflateEnd
1	35	read_buf	call site: 00035	crc32
1	43	deflate	call site: 00043	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

5

Reachable functions

63

Percentage of reachable functions covered

92.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_dict_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	11
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filesexample_large_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	32.3%
gold	[1:9]	1	0.59%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	67.0%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	41	deflate	call site: 00041	crc32
8	142	inflate	call site: 00142	crc32
7	17	crc32_z	call site: 00017	byte_swap
4	62	read_buf	call site: 00062	read_buf
3	0	EP	call site: 00000	test_large_deflate
3	103	deflate_rle	call site: 00103	_tr_flush_block
2	95	deflate_huff	call site: 00095	_tr_flush_block
2	107	_tr_align	call site: 00107	flush_pending
2	139	inflate	call site: 00139	crc32
2	159	inflate	call site: 00159	crc32
1	5	deflateInit_	call site: 00005	deflateEnd
1	33	deflate	call site: 00033	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

4

Reachable functions

61

Percentage of reachable functions covered

93.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_large_fuzzer.c	3
zlib/deflate.c	17
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: gzio_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	29.9%
gold	[1:9]	11	3.58%
yellow	[10:29]	31	10.0%
greenyellow	[30:49]	25	8.14%
lawngreen	50+	148	48.2%
All colors	307	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	189	gz_decomp	call site: 00189	inflate
13	75	deflate	call site: 00075	crc32
7	36	crc32_z	call site: 00036	byte_swap
5	68	_tr_flush_bits	call site: 00068	adler32
5	181	gz_load	call site: 00181	gz_load
4	52	gz_comp	call site: 00052	gz_error
4	59	gz_comp	call site: 00059	gz_error
3	219	gz_read	call site: 00219	gz_error
2	7	gz_open	call site: 00007	fcntl
2	21	gz_comp	call site: 00021	gz_error
2	141	deflate	call site: 00141	putShortMSB
2	224	gzseek	call site: 00224	gzrewind

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

25

Reachable functions

117

Percentage of reachable functions covered

78.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gzio_fuzzer.c	1
zlib/gzlib.c	15
zlib/gzwrite.c	13
zlib/deflate.c	16
zlib/crc32.c	6
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzread.c	15
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1
zlib/zutil.c	3
zlib/gzclose.c	1

Fuzzer: inspector/source-codegzio_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	122	39.7%
gold	[1:9]	5	1.62%
yellow	[10:29]	17	5.53%
greenyellow	[30:49]	10	3.25%
lawngreen	50+	153	49.8%
All colors	307	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	73	deflate	call site: 00073	crc32
8	49	deflateReset	call site: 00049	deflateReset
8	194	inflate	call site: 00194	crc32
7	36	crc32_z	call site: 00036	byte_swap
5	211	inflate	call site: 00211	crc32
5	265	gzvprintf	call site: 00265	gzprintf
5	291	gzclose_r	call site: 00291	gzclose
4	59	gz_comp	call site: 00059	gz_error
4	94	read_buf	call site: 00094	read_buf
4	219	gz_read	call site: 00219	gzseek
3	0	EP	call site: 00000	gzopen
3	7	gz_open	call site: 00007	fcntl

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

16

Reachable functions

117

Percentage of reachable functions covered

86.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codegzio_fuzzer.c	1
zlib/gzlib.c	15
zlib/gzwrite.c	13
zlib/deflate.c	16
zlib/crc32.c	6
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzread.c	15
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1
zlib/zutil.c	3
zlib/gzclose.c	1

Fuzzer: inspector/light/source_filesexample_small_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	53	33.3%
gold	[1:9]	1	0.62%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	105	66.0%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	133	inflate	call site: 00133	crc32
7	18	crc32_z	call site: 00018	byte_swap
4	0	EP	call site: 00000	test_deflate
4	63	read_buf	call site: 00063	read_buf
3	104	deflate_rle	call site: 00104	_tr_flush_block
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	108	_tr_align	call site: 00108	flush_pending
2	130	inflate	call site: 00130	crc32
2	150	inflate	call site: 00150	crc32
1	6	deflateInit_	call site: 00006	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

5

Reachable functions

62

Percentage of reachable functions covered

91.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesexample_small_fuzzer.c	3
zlib/compress.c	1
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/source-codecompress_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	52	33.1%
gold	[1:9]	1	0.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	66.2%
All colors	157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	42	deflate	call site: 00042	crc32
8	129	inflate	call site: 00129	crc32
7	19	crc32_z	call site: 00019	byte_swap
4	0	EP	call site: 00000	check_compress_level
4	63	read_buf	call site: 00063	read_buf
3	104	deflate_rle	call site: 00104	_tr_flush_block
2	96	deflate_huff	call site: 00096	_tr_flush_block
2	108	_tr_align	call site: 00108	flush_pending
2	126	inflate	call site: 00126	crc32
2	146	inflate	call site: 00146	crc32
1	7	deflateInit_	call site: 00007	deflateEnd
1	34	deflate	call site: 00034	flush_pending

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

5

Reachable functions

66

Percentage of reachable functions covered

92.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/source-codecompress_fuzzer.c	4
zlib/compress.c	2
zlib/deflate.c	16
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/uncompr.c	2
zlib/inflate.c	10
zlib/inftrees.c	1
zlib/inffast.c	1

Fuzzer: inspector/light/source_filesgzio_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	122	39.7%
gold	[1:9]	5	1.62%
yellow	[10:29]	17	5.53%
greenyellow	[30:49]	10	3.25%
lawngreen	50+	153	49.8%
All colors	307	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	73	deflate	call site: 00073	crc32
8	49	deflateReset	call site: 00049	deflateReset
8	194	inflate	call site: 00194	crc32
7	36	crc32_z	call site: 00036	byte_swap
5	211	inflate	call site: 00211	crc32
5	265	gzvprintf	call site: 00265	gzprintf
5	291	gzclose_r	call site: 00291	gzclose
4	59	gz_comp	call site: 00059	gz_error
4	94	read_buf	call site: 00094	read_buf
4	219	gz_read	call site: 00219	gzseek
3	0	EP	call site: 00000	gzopen
3	7	gz_open	call site: 00007	fcntl

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

16

Reachable functions

117

Percentage of reachable functions covered

86.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesgzio_fuzzer.c	1
zlib/gzlib.c	15
zlib/gzwrite.c	13
zlib/deflate.c	16
zlib/crc32.c	6
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzread.c	15
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1
zlib/zutil.c	3
zlib/gzclose.c	1

Fuzzer: inspector/light/source_filesminigzip_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	38.7%
gold	[1:9]	1	0.36%
yellow	[10:29]	6	2.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	162	58.6%
All colors	276	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	92	deflate	call site: 00092	crc32
9	266	file_uncompress	call site: 00266	error
8	0	EP	call site: 00000	file_compress
8	229	inflate	call site: 00229	crc32
7	52	crc32_z	call site: 00052	byte_swap
7	69	gz_comp	call site: 00069	deflateReset
5	246	inflate	call site: 00246	crc32
4	78	gz_comp	call site: 00078	gz_error
4	113	read_buf	call site: 00113	read_buf
3	18	gz_open	call site: 00018	fcntl
3	154	deflate_rle	call site: 00154	_tr_flush_block
3	216	gz_load	call site: 00216	__errno_location

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

23

Reachable functions

101

Percentage of reachable functions covered

77.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
inspector/light/source_filesminigzip_fuzzer.c	6
zlib/gzlib.c	5
zlib/gzwrite.c	6
zlib/deflate.c	15
zlib/crc32.c	5
zlib/adler32.c	2
zlib/trees.c	20
zlib/gzclose.c	1
zlib/gzread.c	9
zlib/inflate.c	9
zlib/inftrees.c	1
zlib/inffast.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
deflate_slow	/src/zlib/deflate.c	2	['N/A', 'int']	5	0	1013	92	34	29	0	255	56

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

141 / 166

Cyclomatic complexity statically reachable by fuzzers

1501 / 1631

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

checksum_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z']

zlib_uncompress3_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['inflate', 'adler32']

example_flush_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'read_buf', '_tr_stored_block']

minigzip_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflate_rle', 'inflate', 'crc32_z', 'gz_comp', '_tr_flush_bits', 'gz_open', '_tr_stored_block', 'read_buf']

example_large_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'deflate_stored', 'deflateInit_']

inspector/light/source_fileszlib_uncompress2_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/source-codechecksum_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_combine64', 'crc32_z', 'crc32_combine_op', 'x2nmodp', 'adler32', 'adler32_combine']

inspector/light/source_filesexample_flush_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

inspector/source-codezlib_uncompress3_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/light/source_fileszlib_uncompress_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/source-codeexample_flush_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

inspector/light/source_fileszlib_uncompress3_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/source-codeexample_small_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

compress_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'read_buf', 'deflateInit_']

example_dict_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', 'deflate_rle', '_tr_stored_block', 'deflate_huff', 'test_dict_deflate', 'read_buf']

inspector/source-codezlib_uncompress2_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/light/source_filescompress_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

example_small_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateResetKeep', 'inflate', '_tr_flush_block', 'read_buf', '_tr_stored_block']

zlib_uncompress2_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['inflate', 'adler32']

inspector/source-codezlib_uncompress_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_z', 'adler32', 'inflate']

inspector/source-codeexample_large_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

inspector/light/source_fileschecksum_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['crc32_combine64', 'crc32_z', 'crc32_combine_op', 'x2nmodp', 'adler32', 'adler32_combine']

inspector/source-codeexample_dict_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_stored', 'deflate_rle', 'deflate_huff', '_tr_align', 'test_dict_deflate']

inspector/source-codeminigzip_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'file_uncompress', 'inflate', 'crc32_z', 'gz_comp', 'read_buf', 'gz_open']

zlib_uncompress_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['inflate', 'adler32']

inspector/light/source_filesexample_dict_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'deflate_stored', 'deflate_rle', 'deflate_huff', '_tr_align', 'test_dict_deflate']

inspector/light/source_filesexample_large_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

gzio_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['gz_decomp', 'deflate', 'crc32_z', '_tr_flush_bits', 'gz_load', 'gz_comp', 'gz_read', 'gz_open']

inspector/source-codegzio_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateReset', 'inflate', 'crc32_z', 'gzvprintf', 'gzclose_r', 'gz_comp', 'read_buf', 'gz_read']

inspector/light/source_filesexample_small_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

inspector/source-codecompress_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'inflate', 'crc32_z', 'read_buf', 'deflate_rle', 'deflate_huff', '_tr_align']

inspector/light/source_filesgzio_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'deflateReset', 'inflate', 'crc32_z', 'gzvprintf', 'gzclose_r', 'gz_comp', 'read_buf', 'gz_read']

inspector/light/source_filesminigzip_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['deflate', 'file_uncompress', 'inflate', 'crc32_z', 'gz_comp', 'read_buf', 'gz_open']