High level conclusions

Fuzzers reach 69.43% code coverage.

Fuzzers reach 44.48% of cyclomatic complexity.

Fuzzers reach 58.14% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

974 / 1675

Cyclomatic complexity statically reachable by fuzzers

6913 / 15541

Runtime code coverage of functions

1163 / 1675

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: huf_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	81	31.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	179	68.8%
All colors	260	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	9	FUZZ_dataProducer_int32Range	call site: 00005	/src/zstd/tests/fuzz/fuzz_data_producer.c:60

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

5

Reachable functions

82

Percentage of reachable functions covered

93.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
huf_decompress.c	1
fuzz_data_producer.c	5
fuzz_helpers.c	1
../../lib/common/cpu.h	1
../../lib/decompress/huf_decompress.c	28
../../lib/common/entropy_common.c	8
../../lib/common/fse_decompress.c	4
../../lib/common/mem.h	8
../../lib/common/bits.h	3
../../lib/common/error_private.h	1
../../lib/common/bitstream.h	3
../../lib/common/fse.h	1
../../lib/decompress/../common/error_private.h	1
../../lib/common/zstd_common.c	1
../../lib/decompress/../common/bits.h	3

Fuzzer: block_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	237	48.0%
gold	[1:9]	2	0.40%
yellow	[10:29]	1	0.20%
greenyellow	[30:49]	1	0.20%
lawngreen	50+	252	51.1%
All colors	493	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	290	290	HUF_readStats_wksp	call site: 00190	/src/zstd/tests/fuzz/../../lib/common/entropy_common.c:334
0	0	None	234	234	ZSTD_decompressSequencesSplitLitBuffer	call site: 00418	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:1962
0	0	None	215	215	FSE_decompress_wksp_bmi2	call site: 00192	/src/zstd/tests/fuzz/../../lib/common/fse_decompress.c:303
0	0	None	165	165	HUF_decompress4X2_usingDTable_internal	call site: 00096	/src/zstd/tests/fuzz/../../lib/decompress/huf_decompress.c:1664
0	0	None	101	101	HUF_decompress4X1_usingDTable_internal	call site: 00149	/src/zstd/tests/fuzz/../../lib/decompress/huf_decompress.c:853
0	0	None	27	27	ZSTD_buildFSETable	call site: 00315	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:632
0	0	None	21	21	FUZZ_malloc_rand	call site: 00004	/src/zstd/tests/fuzz/fuzz_helpers.c:28
0	0	None	0	0	ZSTD_customFree	call site: 00476	/src/zstd/tests/fuzz/../../lib/decompress/../common/allocations.h:48
0	0	None	0	0	ZSTD_customMalloc	call site: 00014	/src/zstd/tests/fuzz/../../lib/decompress/../common/allocations.h:28
0	0	1 : View List ['ZSTD_customFree.2473']	0	0	ZSTD_freeDDict	call site: 00475	/src/zstd/tests/fuzz/../../lib/decompress/zstd_ddict.c:214

Runtime coverage analysis

Covered functions

134

Functions that are reachable but not covered

17

Reachable functions

54

Percentage of reachable functions covered

68.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
block_decompress.c	1
fuzz_data_producer.c	4
fuzz_helpers.c	2
../../lib/decompress/zstd_decompress.c	9
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
../../lib/common/cpu.h	2
../../lib/decompress/zstd_decompress_block.c	30
../../lib/decompress/../common/mem.h	9
../../lib/decompress/zstd_decompress_internal.h	1
../../lib/decompress/huf_decompress.c	33
../../lib/common/bitstream.h	4
../../lib/common/mem.h	8
../../lib/decompress/../common/bits.h	3
../../lib/decompress/../common/error_private.h	1
../../lib/common/entropy_common.c	8
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/error_private.h	1
../../lib/common/fse.h	1
../../lib/decompress/../common/zstd_internal.h	2
../../lib/decompress/zstd_ddict.c	1
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: block_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	763	49.5%
gold	[1:9]	9	0.58%
yellow	[10:29]	2	0.12%
greenyellow	[30:49]	5	0.32%
lawngreen	50+	762	49.4%
All colors	1541	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1110	1112	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadDictionaryContent', 'MEM_readLE32.474', 'ZSTD_loadZstdDictionary']	1110	1112	ZSTD_compress_insertDictionary	call site: 00291	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5040
341	341	2 : View List ['ZSTD_ldm_generateSequences', 'ZSTD_ldm_blockCompress']	341	343	ZSTD_buildSeqStore	call site: 00629	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3261
192	205	9 : View List ['ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeBufferPool', 'POOL_free', 'ZSTDMT_freeCCtxPool', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeJobsTable', 'ZSTDMT_serialState_free', 'ZSTD_freeCDict', 'ZSTD_customFree.2175']	192	205	ZSTDMT_freeCCtx	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1015
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_6_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:429
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:429
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_0']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:442
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_1']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:429
20	20	1 : View List ['ZSTD_writeFrameHeader']	1624	2521	ZSTD_compressContinue_internal	call site: 00547	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4641
12	12	3 : View List ['HUF_getNbBitsFromCTable', 'FSE_initCState.1921', 'FSE_getMaxNbBits']	12	31	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:158
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	15	565	ZSTD_resetCCtx_internal	call site: 00105	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:2110

Runtime coverage analysis

Covered functions

440

Functions that are reachable but not covered

161

Reachable functions

420

Percentage of reachable functions covered

61.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
block_round_trip.c	2
fuzz_data_producer.c	6
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	108
../../lib/compress/../common/allocations.h	2
../../lib/compress/../common/zstd_internal.h	3
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	32
../../lib/common/error_private.h	1
../../lib/decompress/zstd_decompress.c	9
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
../../lib/compress/zstd_compress_internal.h	29
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	20
../../lib/common/xxhash.h	6
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/common/mem.h	16
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	5
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/common/zstd_common.c	1
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/decompress/zstd_decompress_block.c	30
../../lib/decompress/../common/mem.h	9
../../lib/decompress/zstd_decompress_internal.h	1
../../lib/decompress/huf_decompress.c	33
../../lib/decompress/../common/bits.h	3
../../lib/decompress/../common/error_private.h	1
../../lib/decompress/../common/zstd_internal.h	2
../../lib/decompress/zstd_ddict.c	1
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: decompress_dstSize_tooSmall

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	641	52.3%
gold	[1:9]	2	0.16%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	581	47.4%
All colors	1224	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1110	1112	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadDictionaryContent', 'MEM_readLE32.474', 'ZSTD_loadZstdDictionary']	1110	1112	ZSTD_compress_insertDictionary	call site: 00287	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5040
341	341	2 : View List ['ZSTD_ldm_generateSequences', 'ZSTD_ldm_blockCompress']	341	343	ZSTD_buildSeqStore	call site: 00619	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3261
314	314	4 : View List ['ZSTD_compressBlock_fast_noDict_6_1', 'ZSTD_compressBlock_fast_noDict_4_1', 'ZSTD_compressBlock_fast_noDict_5_1', 'ZSTD_compressBlock_fast_noDict_7_1']	314	314	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:428
192	205	9 : View List ['ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeBufferPool', 'POOL_free', 'ZSTDMT_freeCCtxPool', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeJobsTable', 'ZSTDMT_serialState_free', 'ZSTD_freeCDict', 'ZSTD_customFree.2175']	192	205	ZSTDMT_freeCCtx	call site: 01162	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1015
126	126	5 : View List ['ZSTD_fseBitCost', 'ZSTD_entropyCost', 'ZSTD_crossEntropyCost', 'ZSTD_NCountCost', 'ERR_isError.798']	126	126	ZSTD_selectEncodingType	call site: 00801	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress_sequences.c:179
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_0']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:442
12	326	6 : View List ['ERR_isError.412', 'HUF_estimateCompressedSize', 'HUF_cardinality', 'HUF_writeCTable_wksp', 'HUF_buildCTable_wksp', 'HUF_minTableLog']	12	326	HUF_optimalTableLog	call site: 00712	/src/zstd/tests/fuzz/../../lib/compress/huf_compress.c:1251
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	11	565	ZSTD_resetCCtx_internal	call site: 00101	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:2110
7	7	1 : View List ['ZSTD_ldm_skipRawSeqStoreBytes']	7	7	ZSTD_buildSeqStore	call site: 00581	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3209
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2483	ZSTD_compressContinue_internal	call site: 00554	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4661
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.463']	27	55	ZSTD_writeEpilogue	call site: 01120	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5188
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00695	/src/zstd/tests/fuzz/../../lib/compress/hist.c:160

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

165

Reachable functions

418

Percentage of reachable functions covered

60.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
decompress_dstSize_tooSmall.c	1
fuzz_data_producer.c	4
fuzz_helpers.c	1
../../lib/compress/zstd_compress.c	110
../../lib/compress/../common/allocations.h	2
../../lib/compress/../common/zstd_internal.h	3
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	32
../../lib/common/error_private.h	2
../../lib/decompress/zstd_decompress.c	9
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
../../lib/compress/zstd_compress_internal.h	29
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	20
../../lib/common/xxhash.h	11
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/common/mem.h	15
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/common/zstd_common.c	2
../../lib/decompress/zstd_ddict.c	1
../../lib/compress/zstdmt_compress.c	8
../../lib/common/pool.c	2
../../lib/common/threading.c	2
../../lib/common/../common/allocations.h	1
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: simple_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	22	48.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	23	51.1%
All colors	45	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
52	56	2 : View List ['HUFv05_decompress1X4_usingDTable', 'HUFv05_isError']	52	56	ZSTDv05_decodeLiteralsBlock	call site: 00000	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v05.c:2867
52	52	2 : View List ['ERR_isError.4868', 'HUFv06_decompress1X4_usingDTable']	52	52	ZSTDv06_decodeLiteralsBlock	call site: 00000	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v06.c:3060
0	14	3 : View List ['ZSTDv05_wildcopy', 'ZSTDv05_copy8', 'ZSTDv05_copy4']	0	14	ZSTDv05_execSequence	call site: 00000	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v05.c:3204
0	14	3 : View List ['ZSTDv06_copy4', 'ZSTDv06_copy8', 'ZSTDv06_wildcopy']	0	14	ZSTDv06_execSequence	call site: 00000	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v06.c:3344
0	14	3 : View List ['ZSTDv07_wildcopy', 'ZSTDv07_copy8', 'ZSTDv07_copy4']	0	14	ZSTDv07_execSequence	call site: 00000	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v07.c:3569
0	0	None	290	290	HUF_readStats_wksp	call site: 00000	/src/zstd/tests/fuzz/../../lib/common/entropy_common.c:334
0	0	None	234	234	ZSTD_decompressSequencesSplitLitBuffer	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:1962
0	0	None	215	215	FSE_decompress_wksp_bmi2	call site: 00000	/src/zstd/tests/fuzz/../../lib/common/fse_decompress.c:303
0	0	None	165	165	HUF_decompress4X2_usingDTable_internal	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/huf_decompress.c:1664
0	0	None	101	101	HUF_decompress4X1_usingDTable_internal	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/huf_decompress.c:853
0	0	None	27	27	ZSTD_buildFSETable	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:632
0	0	None	24	2058	ZSTD_decompressMultiFrame	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:1116

Runtime coverage analysis

Covered functions

453

Functions that are reachable but not covered

2

Reachable functions

53

Percentage of reachable functions covered

96.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
simple_decompress.c	1
fuzz_data_producer.c	5
fuzz_helpers.c	1
../../lib/decompress/zstd_decompress.c	9
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
../../lib/common/cpu.h	2
../../lib/decompress/zstd_ddict.c	1
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: raw_dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	320	17.6%
gold	[1:9]	4	0.22%
yellow	[10:29]	2	0.11%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1485	81.9%
All colors	1811	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.474']	518	814	ZSTD_compress_insertDictionary	call site: 00347	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5048
432	432	3 : View List ['ZSTD_loadDEntropy', 'ERR_isError.2472', 'MEM_readLE32.2471']	432	432	ZSTD_loadEntropy_intoDDict	call site: 01727	/src/zstd/tests/fuzz/../../lib/decompress/zstd_ddict.c:95
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	12	990	ZSTDMT_initCStream_internal	call site: 00720	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1240
12	12	3 : View List ['HUF_getNbBitsFromCTable', 'FSE_initCState.1921', 'FSE_getMaxNbBits']	12	31	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:158
6	6	1 : View List ['ZSTD_window_isEmpty']	6	435	ZSTD_loadDictionaryContent	call site: 00358	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4780
0	84	1 : View List ['ZSTD_freeCCtx']	2	86	ZSTDMT_releaseCCtx	call site: 01638	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:437
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 01127	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3312
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2483	ZSTD_compressContinue_internal	call site: 01067	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4661
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:305
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.463']	27	55	ZSTD_writeEpilogue	call site: 01600	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5188
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 01162	/src/zstd/tests/fuzz/../../lib/compress/hist.c:160
0	3	1 : View List ['ZSTD_rollingHash_append']	0	20	findSynchronizationPoint	call site: 00917	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1727

Runtime coverage analysis

Covered functions

795

Functions that are reachable but not covered

68

Reachable functions

551

Percentage of reachable functions covered

87.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
raw_dictionary_round_trip.c	2
fuzz_data_producer.c	5
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	136
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	4
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	1
../../lib/decompress/zstd_decompress.c	12
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
zstd_helpers.c	6
../../lib/compress/zstd_compress_internal.h	34
../../lib/compress/../common/bits.h	5
../../lib/common/zstd_common.c	1
../../contrib/externalSequenceProducer/sequence_producer.c	1
../../lib/common/mem.h	15
../../lib/compress/zstd_ldm.c	20
../../lib/common/xxhash.h	11
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstdmt_compress.c	50
../../lib/common/pool.c	9
../../lib/common/../common/allocations.h	2
../../lib/common/threading.c	4
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/decompress/zstd_ddict.c	4
../../lib/legacy/../common/mem.h	2
../../lib/decompress/huf_decompress.c	8
../../lib/decompress/../common/error_private.h	1
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/zstd_decompress_block.c	3
../../lib/decompress/../common/mem.h	1
../../lib/decompress/../common/bits.h	2
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: dictionary_stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	198	10.0%
gold	[1:9]	4	0.20%
yellow	[10:29]	7	0.35%
greenyellow	[30:49]	5	0.25%
lawngreen	50+	1749	89.0%
All colors	1963	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	12	990	ZSTDMT_initCStream_internal	call site: 01570	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1240
6	6	1 : View List ['ZSTD_window_isEmpty']	6	435	ZSTD_loadDictionaryContent	call site: 00284	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4780
4	4	2 : View List ['fwrite', 'fflush']	4	101	ZDICT_analyzeEntropy	call site: 01268	/src/zstd/tests/fuzz/../../lib/dictBuilder/zdict.c:813
0	84	1 : View List ['ZSTD_freeCCtx']	2	86	ZSTDMT_releaseCCtx	call site: 01787	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:437
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 00777	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3312
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:305
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.463']	0	55	ZSTD_writeEpilogue	call site: 01750	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5188
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00813	/src/zstd/tests/fuzz/../../lib/compress/hist.c:160
0	3	1 : View List ['FASTCOVER_ctx_destroy']	4	7	FASTCOVER_ctx_init	call site: 00065	/src/zstd/tests/fuzz/../../lib/dictBuilder/fastcover.c:383
0	0	None	295	295	ZSTD_decompressSequencesLong	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:1985
0	0	None	165	165	HUF_decompress4X2_usingDTable_internal	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/huf_decompress.c:1664
0	0	None	123	4528	ZSTD_compressStream2	call site: 01466	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:6289

Runtime coverage analysis

Covered functions

847

Functions that are reachable but not covered

49

Reachable functions

584

Percentage of reachable functions covered

91.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dictionary_stream_round_trip.c	4
fuzz_data_producer.c	5
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	143
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	4
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	1
../../lib/decompress/zstd_decompress.c	12
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
zstd_helpers.c	7
../../lib/dictBuilder/fastcover.c	9
../../lib/dictBuilder/cover.c	3
../../lib/dictBuilder/../compress/zstd_compress_internal.h	4
../../lib/common/mem.h	15
../../lib/dictBuilder/zdict.c	8
../../lib/common/xxhash.h	11
../../lib/dictBuilder/../common/bits.h	2
../../lib/compress/zstd_compress_internal.h	34
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	20
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/compress/zstdmt_compress.c	50
../../lib/common/pool.c	9
../../lib/common/threading.c	4
../../lib/common/../common/allocations.h	2
../../lib/common/zstd_common.c	1
../../contrib/externalSequenceProducer/sequence_producer.c	1
../../lib/decompress/zstd_ddict.c	4
../../lib/legacy/../common/mem.h	2
../../lib/decompress/huf_decompress.c	8
../../lib/decompress/../common/error_private.h	1
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/zstd_decompress_block.c	3
../../lib/decompress/../common/mem.h	1
../../lib/decompress/../common/bits.h	2
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: dictionary_loader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	925	53.3%
gold	[1:9]	2	0.11%
yellow	[10:29]	2	0.11%
greenyellow	[30:49]	2	0.11%
lawngreen	50+	803	46.3%
All colors	1734	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2726	2760	4 : View List ['ZSTDMT_compressStream_generic', 'ZSTDMT_updateCParams_whileCompressing', 'ZSTD_CCtx_trace', 'ZSTD_CCtx_reset']	2726	2763	ZSTD_compressStream2	call site: 00804	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:6314
1387	1387	3 : View List ['ZSTDMT_createCCtx_advanced', 'ZSTDMT_initCStream_internal', 'ZSTD_trace_compress_begin']	1387	1387	ZSTD_CCtx_init_compressStream2	call site: 00467	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:6221
341	341	2 : View List ['ZSTD_ldm_generateSequences', 'ZSTD_ldm_blockCompress']	341	343	ZSTD_buildSeqStore	call site: 01035	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3261
316	316	1 : View List ['ZSTD_compressBlock_doubleFast_extDict_6']	316	316	ZSTD_compressBlock_doubleFast_extDict	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:748
316	316	1 : View List ['ZSTD_compressBlock_doubleFast_extDict_7']	316	316	ZSTD_compressBlock_doubleFast_extDict	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:748
192	205	9 : View List ['ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeBufferPool', 'POOL_free', 'ZSTDMT_freeCCtxPool', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeJobsTable', 'ZSTDMT_serialState_free', 'ZSTD_freeCDict', 'ZSTD_customFree.2175']	192	205	ZSTDMT_freeCCtx	call site: 00581	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1015
126	126	5 : View List ['ZSTD_fseBitCost', 'ZSTD_entropyCost', 'ZSTD_crossEntropyCost', 'ZSTD_NCountCost', 'ERR_isError.798']	126	126	ZSTD_selectEncodingType	call site: 01185	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress_sequences.c:179
121	121	1 : View List ['ZSTD_compressBlock_doubleFast_dictMatchState_6']	121	121	ZSTD_compressBlock_doubleFast_dictMatchState	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:579
121	121	1 : View List ['ZSTD_compressBlock_doubleFast_dictMatchState_7']	121	121	ZSTD_compressBlock_doubleFast_dictMatchState	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:579
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
59	68	2 : View List ['ZSTD_window_update', 'ZSTD_ldm_fillHashTable']	304	420	ZSTD_loadDictionaryContent	call site: 00226	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4789

Runtime coverage analysis

Covered functions

438

Functions that are reachable but not covered

225

Reachable functions

539

Percentage of reachable functions covered

58.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dictionary_loader.c	3
fuzz_data_producer.c	4
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	131
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	4
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	1
../../lib/common/zstd_common.c	1
../../lib/compress/zstd_compress_internal.h	34
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	20
../../lib/common/xxhash.h	11
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/common/mem.h	15
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstdmt_compress.c	50
../../lib/common/pool.c	9
../../lib/common/../common/allocations.h	2
../../lib/common/threading.c	4
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/decompress/zstd_decompress.c	12
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
../../lib/decompress/zstd_ddict.c	4
../../lib/legacy/../common/mem.h	2
../../lib/decompress/huf_decompress.c	8
../../lib/decompress/../common/error_private.h	1
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/zstd_decompress_block.c	3
../../lib/decompress/../common/mem.h	1
../../lib/decompress/../common/bits.h	2
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: simple_compress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	498	41.6%
gold	[1:9]	1	0.08%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	694	58.0%
All colors	1195	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1110	1112	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadDictionaryContent', 'MEM_readLE32.474', 'ZSTD_loadZstdDictionary']	1110	1112	ZSTD_compress_insertDictionary	call site: 00284	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5040
341	341	2 : View List ['ZSTD_ldm_generateSequences', 'ZSTD_ldm_blockCompress']	341	343	ZSTD_buildSeqStore	call site: 00616	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3261
192	205	9 : View List ['ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeBufferPool', 'POOL_free', 'ZSTDMT_freeCCtxPool', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeJobsTable', 'ZSTDMT_serialState_free', 'ZSTD_freeCDict', 'ZSTD_customFree.2175']	192	205	ZSTDMT_freeCCtx	call site: 01150	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1015
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:429
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_1']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:429
12	12	3 : View List ['HUF_getNbBitsFromCTable', 'FSE_initCState.1921', 'FSE_getMaxNbBits']	12	31	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:158
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	11	565	ZSTD_resetCCtx_internal	call site: 00098	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:2110
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2483	ZSTD_compressContinue_internal	call site: 00551	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4661
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.463']	27	55	ZSTD_writeEpilogue	call site: 01117	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5188
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00692	/src/zstd/tests/fuzz/../../lib/compress/hist.c:160

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

126

Reachable functions

395

Percentage of reachable functions covered

68.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
simple_compress.c	1
fuzz_data_producer.c	6
fuzz_helpers.c	1
../../lib/compress/zstd_compress.c	110
../../lib/compress/../common/allocations.h	2
../../lib/compress/../common/zstd_internal.h	3
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	32
../../lib/common/error_private.h	2
../../lib/compress/zstd_compress_internal.h	29
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	20
../../lib/common/xxhash.h	11
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/common/mem.h	15
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/common/zstd_common.c	2
../../lib/compress/zstdmt_compress.c	8
../../lib/common/pool.c	2
../../lib/common/threading.c	2
../../lib/common/../common/allocations.h	1

Fuzzer: dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	281	14.2%
gold	[1:9]	3	0.15%
yellow	[10:29]	4	0.20%
greenyellow	[30:49]	2	0.10%
lawngreen	50+	1688	85.3%
All colors	1978	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	12	990	ZSTDMT_initCStream_internal	call site: 01610	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1240
6	6	1 : View List ['ZSTD_window_isEmpty']	6	435	ZSTD_loadDictionaryContent	call site: 00286	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4780
4	4	2 : View List ['fwrite', 'fflush']	4	101	ZDICT_analyzeEntropy	call site: 01268	/src/zstd/tests/fuzz/../../lib/dictBuilder/zdict.c:813
0	84	1 : View List ['ZSTD_freeCCtx']	2	86	ZSTDMT_releaseCCtx	call site: 01804	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:437
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 00777	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3312
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:305
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.463']	27	55	ZSTD_writeEpilogue	call site: 01348	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5188
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00813	/src/zstd/tests/fuzz/../../lib/compress/hist.c:160
0	3	1 : View List ['FASTCOVER_ctx_destroy']	4	7	FASTCOVER_ctx_init	call site: 00066	/src/zstd/tests/fuzz/../../lib/dictBuilder/fastcover.c:383
0	3	1 : View List ['ZSTD_rollingHash_append']	0	20	findSynchronizationPoint	call site: 01689	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1727
0	0	None	295	295	ZSTD_decompressSequencesLong	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:1985
0	0	None	234	234	ZSTD_decompressSequencesSplitLitBuffer	call site: 00000	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:1962

Runtime coverage analysis

Covered functions

846

Functions that are reachable but not covered

62

Reachable functions

589

Percentage of reachable functions covered

89.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dictionary_round_trip.c	2
fuzz_data_producer.c	8
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	147
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	4
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	1
../../lib/decompress/zstd_decompress.c	12
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
zstd_helpers.c	7
../../lib/dictBuilder/fastcover.c	9
../../lib/dictBuilder/cover.c	3
../../lib/dictBuilder/../compress/zstd_compress_internal.h	4
../../lib/common/mem.h	15
../../lib/dictBuilder/zdict.c	8
../../lib/common/xxhash.h	11
../../lib/dictBuilder/../common/bits.h	2
../../lib/compress/zstd_compress_internal.h	34
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	20
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/compress/zstdmt_compress.c	50
../../lib/common/pool.c	9
../../lib/common/threading.c	4
../../lib/common/../common/allocations.h	2
../../lib/common/zstd_common.c	1
../../contrib/externalSequenceProducer/sequence_producer.c	1
../../lib/decompress/zstd_ddict.c	4
../../lib/legacy/../common/mem.h	2
../../lib/decompress/huf_decompress.c	8
../../lib/decompress/../common/error_private.h	1
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/zstd_decompress_block.c	3
../../lib/decompress/../common/mem.h	1
../../lib/decompress/../common/bits.h	2
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2

Fuzzer: huf_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	23.6%
gold	[1:9]	3	0.67%
yellow	[10:29]	1	0.22%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	335	75.4%
All colors	444	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00022	/src/zstd/tests/fuzz/../../lib/compress/hist.c:160
0	0	None	0	9	FUZZ_dataProducer_int32Range	call site: 00005	/src/zstd/tests/fuzz/fuzz_data_producer.c:60
0	0	None	0	0	FSE_buildDTable_internal	call site: 00164	/src/zstd/tests/fuzz/../../lib/common/fse_decompress.c:93
0	0	None	0	0	FSE_buildCTable_wksp	call site: 00118	/src/zstd/tests/fuzz/../../lib/compress/fse_compress.c:104
0	0	None	0	0	FSE_buildCTable_wksp	call site: 00120	/src/zstd/tests/fuzz/../../lib/compress/fse_compress.c:116
0	0	None	0	0	FSE_normalizeM2	call site: 00108	/src/zstd/tests/fuzz/../../lib/compress/fse_compress.c:414
0	0	None	0	0	FSE_normalizeM2	call site: 00108	/src/zstd/tests/fuzz/../../lib/compress/fse_compress.c:427
0	0	None	0	0	FSE_normalizeM2	call site: 00108	/src/zstd/tests/fuzz/../../lib/compress/fse_compress.c:438
0	0	None	0	0	HIST_count_parallel_wksp	call site: 00024	/src/zstd/tests/fuzz/../../lib/compress/hist.c:83

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

9

Reachable functions

150

Percentage of reachable functions covered

94.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
huf_round_trip.c	2
fuzz_data_producer.c	5
fuzz_helpers.c	2
../../lib/common/cpu.h	1
../../lib/compress/hist.c	5
../../lib/compress/../common/mem.h	1
../../lib/common/zstd_common.c	1
../../lib/common/error_private.h	2
../../lib/common/bits.h	3
../../lib/compress/huf_compress.c	26
../../lib/compress/fse_compress.c	10
../../lib/compress/../common/bits.h	2
../../lib/compress/../common/error_private.h	1
../../lib/common/mem.h	12
../../lib/decompress/huf_decompress.c	28
../../lib/common/entropy_common.c	8
../../lib/common/fse_decompress.c	4
../../lib/common/bitstream.h	3
../../lib/common/fse.h	1
../../lib/decompress/../common/error_private.h	1
../../lib/decompress/../common/bits.h	3

Fuzzer: stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1444	45.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.38%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1684	53.6%
All colors	3140	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
776	776	1 : View List ['ZSTD_createCDict_advanced2']	776	776	ZSTD_initLocalDict	call site: 00206	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:1242
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.474']	518	814	ZSTD_compress_insertDictionary	call site: 00343	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5048
59	68	2 : View List ['ZSTD_window_update', 'ZSTD_ldm_fillHashTable']	111	420	ZSTD_loadDictionaryContent	call site: 00359	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4789
40	40	1 : View List ['ZSTD_fillDoubleHashTableForCDict']	40	40	ZSTD_fillDoubleHashTable	call site: 00412	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:91
36	36	1 : View List ['ZSTD_fillHashTableForCDict']	36	36	ZSTD_fillHashTable	call site: 00396	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:88
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	792	990	ZSTDMT_initCStream_internal	call site: 00716	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1240
12	12	3 : View List ['HUF_getNbBitsFromCTable', 'FSE_initCState.1921', 'FSE_getMaxNbBits']	12	31	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:158
6	6	1 : View List ['ZSTD_window_isEmpty']	117	435	ZSTD_loadDictionaryContent	call site: 00354	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4780
4	4	1 : View List ['ZSTD_nextInputType']	4	4	ZSTD_decompressStream	call site: 03107	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:2346
2	2	1 : View List ['ZSTD_errorFrameSizeInfo']	2	2	ZSTD_findFrameSizeInfo	call site: 02662	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:784
0	84	1 : View List ['ZSTD_freeCCtx']	2	86	ZSTDMT_releaseCCtx	call site: 01635	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:437
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 01123	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3312

Runtime coverage analysis

Covered functions

735

Functions that are reachable but not covered

337

Reachable functions

827

Percentage of reachable functions covered

59.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
stream_round_trip.c	5
fuzz_data_producer.c	5
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	134
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	4
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	1
../../lib/decompress/zstd_decompress.c	40
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	2
zstd_helpers.c	6
../../lib/compress/zstd_compress_internal.h	34
../../lib/compress/../common/bits.h	5
../../lib/common/zstd_common.c	1
../../contrib/externalSequenceProducer/sequence_producer.c	1
../../lib/common/mem.h	16
../../lib/compress/zstd_ldm.c	20
../../lib/common/xxhash.h	11
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	5
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstdmt_compress.c	50
../../lib/common/pool.c	9
../../lib/common/../common/allocations.h	2
../../lib/common/threading.c	4
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/../legacy/zstd_legacy.h	5
../../lib/legacy/zstd_v04.c	61
../../lib/legacy/zstd_v05.c	67
../../lib/legacy/../common/mem.h	11
../../lib/legacy/zstd_v06.c	73
../../lib/legacy/zstd_v07.c	83
../../lib/decompress/zstd_ddict.c	4
../../lib/legacy/zstd_v01.c	5
../../lib/legacy/zstd_v02.c	6
../../lib/legacy/zstd_v03.c	6
../../lib/decompress/zstd_decompress_block.c	29
../../lib/decompress/../common/mem.h	9
../../lib/decompress/zstd_decompress_internal.h	1
../../lib/decompress/huf_decompress.c	33
../../lib/decompress/../common/bits.h	3
../../lib/decompress/../common/error_private.h	1
../../lib/decompress/../common/zstd_internal.h	2

Fuzzer: seekable_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1969	63.6%
gold	[1:9]	1	0.03%
yellow	[10:29]	1	0.03%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1121	36.2%
All colors	3092	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2726	2760	4 : View List ['ZSTDMT_compressStream_generic', 'ZSTDMT_updateCParams_whileCompressing', 'ZSTD_CCtx_trace', 'ZSTD_CCtx_reset']	2726	2763	ZSTD_compressStream2	call site: 00834	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:6314
1387	1387	3 : View List ['ZSTDMT_createCCtx_advanced', 'ZSTDMT_initCStream_internal', 'ZSTD_trace_compress_begin']	1387	1387	ZSTD_CCtx_init_compressStream2	call site: 00582	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:6221
1110	1112	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadDictionaryContent', 'MEM_readLE32.474', 'ZSTD_loadZstdDictionary']	1110	1112	ZSTD_compress_insertDictionary	call site: 00326	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5040
776	776	1 : View List ['ZSTD_createCDict_advanced2']	776	776	ZSTD_initLocalDict	call site: 00169	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:1242
383	383	1 : View List ['ZSTD_compressBlock_fast_extDict_4_0']	383	383	ZSTD_compressBlock_fast_extDict	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:948
383	383	1 : View List ['ZSTD_compressBlock_fast_extDict_5_0']	383	383	ZSTD_compressBlock_fast_extDict	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:948
341	341	2 : View List ['ZSTD_ldm_generateSequences', 'ZSTD_ldm_blockCompress']	341	343	ZSTD_buildSeqStore	call site: 01064	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3261
192	205	9 : View List ['ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeBufferPool', 'POOL_free', 'ZSTDMT_freeCCtxPool', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeJobsTable', 'ZSTDMT_serialState_free', 'ZSTD_freeCDict', 'ZSTD_customFree.2175']	192	205	ZSTDMT_freeCCtx	call site: 00049	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1015
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:559
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:429
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_1']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:429

Runtime coverage analysis

Covered functions

577

Functions that are reachable but not covered

475

Reachable functions

866

Percentage of reachable functions covered

45.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
seekable_roundtrip.c	1
fuzz_data_producer.c	6
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	138
../../contrib/seekable_format/zstdseek_compress.c	12
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	4
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	1
../../lib/common/zstd_common.c	1
../../lib/compress/zstdmt_compress.c	51
../../lib/common/pool.c	9
../../lib/common/threading.c	4
../../lib/common/../common/allocations.h	2
../../contrib/seekable_format/zstdseek_decompress.c	7
../../lib/decompress/zstd_decompress.c	37
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	2
../../lib/common/xxhash.h	11
../../lib/compress/zstd_compress_internal.h	34
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	20
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/common/mem.h	17
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	5
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/decompress/zstd_ddict.c	4
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/../legacy/zstd_legacy.h	5
../../lib/legacy/zstd_v04.c	61
../../lib/legacy/zstd_v05.c	67
../../lib/legacy/../common/mem.h	11
../../lib/legacy/zstd_v06.c	73
../../lib/legacy/zstd_v07.c	83
../../lib/legacy/zstd_v01.c	5
../../lib/legacy/zstd_v02.c	6
../../lib/legacy/zstd_v03.c	6
../../lib/decompress/zstd_decompress_block.c	29
../../lib/decompress/../common/mem.h	9
../../lib/decompress/zstd_decompress_internal.h	1
../../lib/decompress/huf_decompress.c	33
../../lib/decompress/../common/bits.h	3
../../lib/decompress/../common/error_private.h	1
../../lib/decompress/../common/zstd_internal.h	2

Fuzzer: dictionary_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1176	40.1%
gold	[1:9]	7	0.23%
yellow	[10:29]	14	0.47%
greenyellow	[30:49]	2	0.06%
lawngreen	50+	1732	59.0%
All colors	2931	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.474']	518	814	ZSTD_compress_insertDictionary	call site: 00251	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5048
341	341	2 : View List ['ZSTD_ldm_generateSequences', 'ZSTD_ldm_blockCompress']	341	343	ZSTD_buildSeqStore	call site: 00732	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3261
314	314	4 : View List ['ZSTD_compressBlock_fast_noDict_6_1', 'ZSTD_compressBlock_fast_noDict_4_1', 'ZSTD_compressBlock_fast_noDict_5_1', 'ZSTD_compressBlock_fast_noDict_7_1']	314	314	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:428
192	205	9 : View List ['ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeBufferPool', 'POOL_free', 'ZSTDMT_freeCCtxPool', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeJobsTable', 'ZSTDMT_serialState_free', 'ZSTD_freeCDict', 'ZSTD_customFree.2175']	192	205	ZSTDMT_freeCCtx	call site: 01272	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1015
126	126	5 : View List ['ZSTD_fseBitCost', 'ZSTD_entropyCost', 'ZSTD_crossEntropyCost', 'ZSTD_NCountCost', 'ERR_isError.798']	126	126	ZSTD_selectEncodingType	call site: 00912	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress_sequences.c:179
101	101	1 : View List ['ZSTD_compressBlock_fast_dictMatchState_7_0']	101	101	ZSTD_compressBlock_fast_dictMatchState	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:669
99	99	1 : View List ['ZSTD_compressBlock_fast_dictMatchState_4_0']	99	99	ZSTD_compressBlock_fast_dictMatchState	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:669
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_6_0']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:442
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_0']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:442
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_0']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:442
59	68	2 : View List ['ZSTD_window_update', 'ZSTD_ldm_fillHashTable']	311	420	ZSTD_loadDictionaryContent	call site: 00267	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4789
52	56	2 : View List ['HUFv05_decompress1X4_usingDTable', 'HUFv05_isError']	52	56	ZSTDv05_decodeLiteralsBlock	call site: 01960	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v05.c:2867

Runtime coverage analysis

Covered functions

732

Functions that are reachable but not covered

160

Reachable functions

730

Percentage of reachable functions covered

78.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dictionary_decompress.c	1
fuzz_data_producer.c	5
fuzz_helpers.c	1
../../lib/decompress/zstd_decompress.c	31
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
../../lib/common/cpu.h	2
zstd_helpers.c	1
../../lib/dictBuilder/fastcover.c	9
../../lib/dictBuilder/cover.c	3
../../lib/dictBuilder/../compress/zstd_compress_internal.h	4
../../lib/common/mem.h	16
../../lib/common/error_private.h	2
../../lib/dictBuilder/zdict.c	8
../../lib/common/xxhash.h	11
../../lib/dictBuilder/../common/bits.h	2
../../lib/compress/zstd_compress.c	119
../../lib/compress/zstd_compress_internal.h	29
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_cwksp.h	33
../../lib/compress/../common/allocations.h	2
../../lib/compress/zstd_ldm.c	20
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	5
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/../common/zstd_internal.h	3
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/compress/zstdmt_compress.c	8
../../lib/common/pool.c	2
../../lib/common/threading.c	2
../../lib/common/../common/allocations.h	1
../../lib/common/zstd_common.c	2
../../lib/decompress/zstd_ddict.c	9
../../lib/legacy/../common/mem.h	11
../../lib/decompress/huf_decompress.c	33
../../lib/decompress/../common/error_private.h	1
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/zstd_decompress_block.c	29
../../lib/decompress/../common/mem.h	9
../../lib/decompress/../common/bits.h	3
../../lib/decompress/../legacy/zstd_legacy.h	5
../../lib/legacy/zstd_v01.c	50
../../lib/legacy/zstd_v02.c	43
../../lib/legacy/zstd_v03.c	43
../../lib/legacy/zstd_v04.c	51
../../lib/legacy/zstd_v05.c	63
../../lib/legacy/zstd_v06.c	69
../../lib/legacy/zstd_v07.c	79
../../lib/decompress/zstd_decompress_internal.h	1
../../lib/decompress/../common/zstd_internal.h	2

Fuzzer: zstd_frame_info

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	14.1%
gold	[1:9]	1	0.58%
yellow	[10:29]	8	4.70%
greenyellow	[30:49]	1	0.58%
lawngreen	50+	136	80.0%
All colors	170	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	13	ZSTDv01_findFrameSizeInfoLegacy	call site: 00059	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v01.c:1993
0	0	None	0	9	ZSTDv05_findFrameSizeInfoLegacy	call site: 00098	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v05.c:3496
0	0	None	0	5	ZSTDv06_findFrameSizeInfoLegacy	call site: 00109	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v06.c:3638
0	0	None	0	5	ZSTDv07_findFrameSizeInfoLegacy	call site: 00119	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v07.c:3882
0	0	None	0	5	ZSTDv07_findFrameSizeInfoLegacy	call site: 00121	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v07.c:3886
0	0	None	0	2	ZSTDv07_getFrameParams	call site: 00018	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v07.c:3109
0	0	None	0	0	ZSTDv02_findFrameSizeInfoLegacy	call site: 00068	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v02.c:3308
0	0	None	0	0	ZSTDv03_findFrameSizeInfoLegacy	call site: 00078	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v03.c:2947
0	0	None	0	0	ZSTDv04_findFrameSizeInfoLegacy	call site: 00088	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v04.c:3113

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

1

Reachable functions

51

Percentage of reachable functions covered

98.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
zstd_frame_info.c	1
../../lib/decompress/zstd_decompress.c	15
../../lib/decompress/../legacy/zstd_legacy.h	3
../../lib/legacy/../common/mem.h	8
../../lib/legacy/zstd_v05.c	5
../../lib/legacy/zstd_v06.c	11
../../lib/legacy/zstd_v07.c	11
../../lib/legacy/zstd_v01.c	5
../../lib/legacy/../common/error_private.h	1
../../lib/legacy/zstd_v02.c	6
../../lib/legacy/zstd_v03.c	6
../../lib/legacy/zstd_v04.c	6
../../lib/decompress/zstd_decompress_block.c	1
../../lib/decompress/../common/mem.h	3

Fuzzer: stream_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	446	29.2%
gold	[1:9]	6	0.39%
yellow	[10:29]	19	1.24%
greenyellow	[30:49]	7	0.45%
lawngreen	50+	1045	68.6%
All colors	1523	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
52	56	2 : View List ['HUFv05_decompress1X4_usingDTable', 'HUFv05_isError']	52	56	ZSTDv05_decodeLiteralsBlock	call site: 00226	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v05.c:2867
52	52	2 : View List ['ERR_isError.4868', 'HUFv06_decompress1X4_usingDTable']	52	52	ZSTDv06_decodeLiteralsBlock	call site: 00372	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v06.c:3060
0	36	2 : View List ['ERR_isError.5188', 'ZSTDv07_decodeFrameHeader']	0	36	ZSTDv07_decompressContinue	call site: 00472	/src/zstd/tests/fuzz/../../lib/legacy/zstd_v07.c:3960
0	0	None	295	295	ZSTD_decompressSequencesLong	call site: 01336	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:1985
0	0	None	290	290	HUF_readStats_wksp	call site: 01191	/src/zstd/tests/fuzz/../../lib/common/entropy_common.c:334
0	0	None	234	234	ZSTD_decompressSequencesSplitLitBuffer	call site: 01417	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress_block.c:1962
0	0	None	215	215	FSE_decompress_wksp_bmi2	call site: 01193	/src/zstd/tests/fuzz/../../lib/common/fse_decompress.c:303
0	0	None	165	165	HUF_decompress4X2_usingDTable_internal	call site: 01098	/src/zstd/tests/fuzz/../../lib/decompress/huf_decompress.c:1664
0	0	None	101	101	HUF_decompress4X1_usingDTable_internal	call site: 01150	/src/zstd/tests/fuzz/../../lib/decompress/huf_decompress.c:853
0	0	None	60	6406	ZSTD_decompressStream	call site: 00737	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:2119
0	0	None	60	6406	ZSTD_decompressStream	call site: 01009	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:2212
0	0	None	60	6406	ZSTD_decompressStream	call site: 01013	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:2232

Runtime coverage analysis

Covered functions

524

Functions that are reachable but not covered

30

Reachable functions

394

Percentage of reachable functions covered

92.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
stream_decompress.c	3
fuzz_data_producer.c	6
fuzz_helpers.c	1
../../lib/decompress/zstd_decompress.c	40
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	2
../../lib/common/cpu.h	2
../../lib/decompress/zstd_ddict.c	4
../../lib/common/zstd_common.c	1
../../lib/common/error_private.h	1
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/../legacy/zstd_legacy.h	5
../../lib/legacy/zstd_v04.c	61
../../lib/legacy/zstd_v05.c	67
../../lib/legacy/../common/mem.h	11
../../lib/legacy/zstd_v06.c	73
../../lib/legacy/zstd_v07.c	83
../../lib/common/xxhash.h	11
../../lib/legacy/zstd_v01.c	5
../../lib/legacy/zstd_v02.c	6
../../lib/legacy/zstd_v03.c	6
../../lib/decompress/zstd_decompress_block.c	29
../../lib/decompress/../common/mem.h	9
../../lib/decompress/zstd_decompress_internal.h	1
../../lib/decompress/huf_decompress.c	33
../../lib/common/bitstream.h	4
../../lib/common/mem.h	8
../../lib/decompress/../common/bits.h	3
../../lib/decompress/../common/error_private.h	1
../../lib/common/entropy_common.c	8
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/fse.h	1
../../lib/decompress/../common/zstd_internal.h	2

Fuzzer: fse_read_ncount

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8	17.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	37	82.2%
All colors	45	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	70	FSE_readNCount_bmi2	call site: 00026	/src/zstd/tests/fuzz/../../lib/common/entropy_common.c:211
0	0	None	0	9	FUZZ_dataProducer_int32Range	call site: 00008	/src/zstd/tests/fuzz/fuzz_data_producer.c:60

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

8

Reachable functions

22

Percentage of reachable functions covered

63.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fse_read_ncount.c	1
fuzz_data_producer.c	4
fuzz_helpers.c	1
../../lib/compress/fse_compress.c	3
../../lib/common/zstd_common.c	1
../../lib/common/error_private.h	1
../../lib/common/entropy_common.c	4
../../lib/common/mem.h	2
../../lib/common/bits.h	1

Fuzzer: simple_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	495	25.8%
gold	[1:9]	4	0.20%
yellow	[10:29]	1	0.05%
greenyellow	[30:49]	2	0.10%
lawngreen	50+	1413	73.7%
All colors	1915	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
776	776	1 : View List ['ZSTD_createCDict_advanced2']	776	776	ZSTD_initLocalDict	call site: 00196	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:1242
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.474']	518	814	ZSTD_compress_insertDictionary	call site: 00333	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5048
59	68	2 : View List ['ZSTD_window_update', 'ZSTD_ldm_fillHashTable']	111	420	ZSTD_loadDictionaryContent	call site: 00349	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4789
40	40	1 : View List ['ZSTD_fillDoubleHashTableForCDict']	40	40	ZSTD_fillDoubleHashTable	call site: 00402	/src/zstd/tests/fuzz/../../lib/compress/zstd_double_fast.c:91
36	36	1 : View List ['ZSTD_fillHashTableForCDict']	36	36	ZSTD_fillHashTable	call site: 00386	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:88
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	792	990	ZSTDMT_initCStream_internal	call site: 00706	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1240
12	12	3 : View List ['HUF_getNbBitsFromCTable', 'FSE_initCState.1921', 'FSE_getMaxNbBits']	12	31	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/zstd_opt.c:158
6	6	1 : View List ['ZSTD_window_isEmpty']	117	435	ZSTD_loadDictionaryContent	call site: 00344	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4780
2	2	1 : View List ['ZSTD_errorFrameSizeInfo']	2	2	ZSTD_findFrameSizeInfo	call site: 01880	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:784
0	84	1 : View List ['ZSTD_freeCCtx']	2	86	ZSTDMT_releaseCCtx	call site: 01625	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:437
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 01113	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:3312
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2483	ZSTD_compressContinue_internal	call site: 01053	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4661

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

102

Reachable functions

559

Percentage of reachable functions covered

81.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
simple_round_trip.c	3
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	141
fuzz_data_producer.c	8
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	4
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	1
../../lib/decompress/zstd_decompress.c	20
../../lib/decompress/../common/allocations.h	2
../../lib/legacy/../common/zstd_internal.h	1
zstd_helpers.c	6
../../lib/compress/zstd_compress_internal.h	34
../../lib/compress/../common/bits.h	5
../../lib/common/zstd_common.c	1
../../contrib/externalSequenceProducer/sequence_producer.c	1
../../lib/common/mem.h	15
../../lib/compress/zstd_ldm.c	20
../../lib/common/xxhash.h	11
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	28
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	11
../../lib/compress/zstdmt_compress.c	50
../../lib/common/pool.c	9
../../lib/common/../common/allocations.h	2
../../lib/common/threading.c	4
../../lib/compress/zstd_compress_superblock.c	11
../../lib/compress/hist.c	4
../../lib/compress/zstd_compress_sequences.c	11
../../lib/compress/zstd_compress_literals.c	5
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/zstd_ddict.c	1
../../lib/decompress/../legacy/zstd_legacy.h	3
../../lib/legacy/../common/mem.h	8
../../lib/legacy/zstd_v01.c	5
../../lib/legacy/zstd_v02.c	6
../../lib/legacy/zstd_v03.c	6
../../lib/legacy/zstd_v04.c	9
../../lib/legacy/zstd_v05.c	6
../../lib/legacy/zstd_v06.c	8
../../lib/legacy/zstd_v07.c	8
../../lib/decompress/zstd_decompress_block.c	1
../../lib/decompress/../common/mem.h	3

Fuzzer: sequence_compression_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	513	43.1%
gold	[1:9]	66	5.54%
yellow	[10:29]	3	0.25%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	608	51.0%
All colors	1190	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1387	1387	3 : View List ['ZSTDMT_createCCtx_advanced', 'ZSTDMT_initCStream_internal', 'ZSTD_trace_compress_begin']	1387	1387	ZSTD_CCtx_init_compressStream2	call site: 00634	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:6221
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.474']	518	814	ZSTD_compress_insertDictionary	call site: 00257	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:5048
432	432	3 : View List ['ZSTD_loadDEntropy', 'ERR_isError.2472', 'MEM_readLE32.2471']	432	432	ZSTD_loadEntropy_intoDDict	call site: 00507	/src/zstd/tests/fuzz/../../lib/decompress/zstd_ddict.c:95
192	205	9 : View List ['ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeBufferPool', 'POOL_free', 'ZSTDMT_freeCCtxPool', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeJobsTable', 'ZSTDMT_serialState_free', 'ZSTD_freeCDict', 'ZSTD_customFree.2175']	192	205	ZSTDMT_freeCCtx	call site: 00707	/src/zstd/tests/fuzz/../../lib/compress/zstdmt_compress.c:1015
80	80	3 : View List ['ERR_isError.2732', 'ZSTD_createDDictHashSet', 'ZSTD_DDictHashSet_addDDict']	80	80	ZSTD_DCtx_refDDict	call site: 00589	/src/zstd/tests/fuzz/../../lib/decompress/zstd_decompress.c:1768
59	68	2 : View List ['ZSTD_window_update', 'ZSTD_ldm_fillHashTable']	311	420	ZSTD_loadDictionaryContent	call site: 00273	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4789
35	35	1 : View List ['ZSTD_fillHashTableForCCtx']	35	35	ZSTD_fillHashTable	call site: 00310	/src/zstd/tests/fuzz/../../lib/compress/zstd_fast.c:88
34	34	2 : View List ['allBytesIdentical', 'ZSTD_compressRleLiteralsBlock']	34	34	ZSTD_compressLiterals	call site: 00990	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress_literals.c:192
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	11	565	ZSTD_resetCCtx_internal	call site: 00827	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:2110
6	6	1 : View List ['ZSTD_window_isEmpty']	317	435	ZSTD_loadDictionaryContent	call site: 00268	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:4780
0	776	1 : View List ['ZSTD_createCDict_advanced2']	0	776	ZSTD_initLocalDict	call site: 00616	/src/zstd/tests/fuzz/../../lib/compress/zstd_compress.c:1242
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00000	/src/zstd/tests/fuzz/../../lib/compress/hist.c:160

Runtime coverage analysis

Covered functions

415

Functions that are reachable but not covered

145

Reachable functions

414

Percentage of reachable functions covered

64.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
sequence_compression_api.c	6
fuzz_data_producer.c	6
fuzz_helpers.c	2
../../lib/compress/zstd_compress.c	89
../../lib/compress/../common/allocations.h	3
../../lib/compress/../common/zstd_internal.h	1
../../lib/common/cpu.h	2
../../lib/compress/zstd_cwksp.h	33
../../lib/common/error_private.h	2
../../lib/decompress/zstd_decompress.c	16
../../lib/decompress/../common/allocations.h	3
../../lib/legacy/../common/zstd_internal.h	1
../../lib/compress/zstd_compress_internal.h	25
../../lib/compress/../common/bits.h	5
../../lib/compress/zstd_ldm.c	8
../../lib/common/xxhash.h	11
../../lib/compress/zstd_fast.c	3
../../lib/compress/../common/mem.h	13
../../lib/compress/zstd_double_fast.c	3
../../lib/compress/zstd_lazy.c	3
../../lib/common/mem.h	13
../../lib/compress/zstd_opt.c	2
../../lib/compress/huf_compress.c	3
../../lib/common/entropy_common.c	9
../../lib/common/fse_decompress.c	4
../../lib/common/bits.h	3
../../lib/common/bitstream.h	3
../../lib/common/fse.h	4
../../lib/compress/../common/error_private.h	1
../../lib/compress/fse_compress.c	10
../../lib/decompress/zstd_ddict.c	5
../../lib/legacy/../common/mem.h	2
../../lib/decompress/huf_decompress.c	8
../../lib/decompress/../common/error_private.h	1
../../lib/legacy/../common/error_private.h	1
../../lib/decompress/zstd_decompress_block.c	3
../../lib/decompress/../common/mem.h	1
../../lib/decompress/../common/bits.h	2
../../lib/common/zstd_common.c	2
../../lib/compress/zstdmt_compress.c	30
../../lib/common/pool.c	6
../../lib/common/../common/allocations.h	2
../../lib/common/threading.c	4
../../lib/compress/zstd_compress_literals.c	5
../../lib/compress/hist.c	3
../../lib/compress/zstd_compress_sequences.c	11
../../lib/decompress/../legacy/zstd_legacy.h	1
../../lib/legacy/zstd_v04.c	3
../../lib/legacy/zstd_v05.c	2
../../lib/legacy/zstd_v06.c	2
../../lib/legacy/zstd_v07.c	2