High level conclusions

Fuzzers reach 69.63% code coverage.

Fuzzers reach 45.01% of cyclomatic complexity.

Fuzzers reach 58.48% of all functions.

Fuzzer decompress_cross_format is blocked:

The runtime code coverage of decompress_cross_format covers 24.54% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

986 / 1686

Cyclomatic complexity statically reachable by fuzzers

6991 / 15530

Runtime code coverage of functions

1174 / 1686

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fse_read_ncount

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8	17.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	38	82.6%
All colors	46	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	70	FSE_readNCount_bmi2	call site: 00027	/src/zstd/lib/common/entropy_common.c:211
0	0	None	0	9	FUZZ_dataProducer_int32Range	call site: 00008	/src/zstd/tests/fuzz/fuzz_data_producer.c:60

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

8

Reachable functions

22

Percentage of reachable functions covered

63.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fse_read_ncount.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/fse_compress.c	3
lib/common/zstd_common.c	1
lib/common/error_private.h	1
lib/common/entropy_common.c	4
lib/common/mem.h	2
lib/common/bits.h	1

Fuzzer: block_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	242	47.4%
gold	[1:9]	2	0.39%
yellow	[10:29]	1	0.19%
greenyellow	[30:49]	1	0.19%
lawngreen	50+	264	51.7%
All colors	510	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	289	289	HUF_readStats_wksp	call site: 00207	/src/zstd/lib/common/entropy_common.c:334
0	0	None	228	228	ZSTD_decompressSequencesSplitLitBuffer	call site: 00443	/src/zstd/lib/decompress/zstd_decompress_block.c:1965
0	0	None	214	214	FSE_decompress_wksp_bmi2	call site: 00209	/src/zstd/lib/common/fse_decompress.c:305
0	0	None	167	167	HUF_decompress4X2_usingDTable_internal	call site: 00105	/src/zstd/lib/decompress/huf_decompress.c:1726
0	0	None	103	103	HUF_decompress4X1_usingDTable_internal	call site: 00163	/src/zstd/lib/decompress/huf_decompress.c:904
0	0	None	27	27	ZSTD_buildFSETable	call site: 00338	/src/zstd/lib/decompress/zstd_decompress_block.c:632
0	0	None	21	21	FUZZ_malloc_rand	call site: 00004	/src/zstd/tests/fuzz/fuzz_helpers.c:28
0	0	None	0	0	ZSTD_customFree	call site: 00493	/src/zstd/lib/decompress/../common/allocations.h:48
0	0	None	0	0	ZSTD_customMalloc	call site: 00014	/src/zstd/lib/decompress/../common/allocations.h:28
0	0	1 : View List ['ZSTD_customFree.2772']	0	0	ZSTD_freeDDict	call site: 00492	/src/zstd/lib/decompress/zstd_ddict.c:214

Runtime coverage analysis

Covered functions

136

Functions that are reachable but not covered

17

Reachable functions

54

Percentage of reachable functions covered

68.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_decompress.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
lib/common/cpu.h	2
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/mem.h	9
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	33
lib/common/bitstream.h	4
lib/common/mem.h	8
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/common/compiler.h	2
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/error_private.h	1
lib/common/fse.h	1
lib/decompress/../common/zstd_internal.h	2
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: simple_compress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	518	42.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	704	57.5%
All colors	1224	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1106	1108	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadZstdDictionary', 'MEM_readLE32.828', 'ZSTD_loadDictionaryContent']	1106	1108	ZSTD_compress_insertDictionary	call site: 00289	/src/zstd/lib/compress/zstd_compress.c:5081
339	339	2 : View List ['ZSTD_ldm_blockCompress', 'ZSTD_ldm_generateSequences']	339	343	ZSTD_buildSeqStore	call site: 00630	/src/zstd/lib/compress/zstd_compress.c:3264
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 01176	/src/zstd/lib/compress/zstdmt_compress.c:1030
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:434
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_1']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:434
15	15	3 : View List ['FSE_getMaxNbBits', 'FSE_initCState.2204', 'HUF_getNbBitsFromCTable']	15	34	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:158
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	11	573	ZSTD_resetCCtx_internal	call site: 00098	/src/zstd/lib/compress/zstd_compress.c:2114
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2521	ZSTD_compressContinue_internal	call site: 00564	/src/zstd/lib/compress/zstd_compress.c:4703
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:306
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.817']	25	55	ZSTD_writeEpilogue	call site: 01144	/src/zstd/lib/compress/zstd_compress.c:5228

Runtime coverage analysis

Covered functions

383

Functions that are reachable but not covered

128

Reachable functions

400

Percentage of reachable functions covered

68.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_compress.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	110
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	32
lib/common/error_private.h	2
lib/compress/zstd_compress_internal.h	30
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	11
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/common/mem.h	15
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	2
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1

Fuzzer: zstd_frame_info

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	14.0%
gold	[1:9]	3	1.75%
yellow	[10:29]	4	2.33%
greenyellow	[30:49]	3	1.75%
lawngreen	50+	137	80.1%
All colors	171	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	13	ZSTDv01_findFrameSizeInfoLegacy	call site: 00060	/src/zstd/lib/legacy/zstd_v01.c:1994
0	0	None	0	9	ZSTDv05_findFrameSizeInfoLegacy	call site: 00099	/src/zstd/lib/legacy/zstd_v05.c:3496
0	0	None	0	5	ZSTDv06_findFrameSizeInfoLegacy	call site: 00110	/src/zstd/lib/legacy/zstd_v06.c:3630
0	0	None	0	5	ZSTDv07_findFrameSizeInfoLegacy	call site: 00120	/src/zstd/lib/legacy/zstd_v07.c:3874
0	0	None	0	5	ZSTDv07_findFrameSizeInfoLegacy	call site: 00122	/src/zstd/lib/legacy/zstd_v07.c:3878
0	0	None	0	2	ZSTDv07_getFrameParams	call site: 00018	/src/zstd/lib/legacy/zstd_v07.c:3101
0	0	None	0	0	ZSTDv02_findFrameSizeInfoLegacy	call site: 00069	/src/zstd/lib/legacy/zstd_v02.c:3295
0	0	None	0	0	ZSTDv03_findFrameSizeInfoLegacy	call site: 00079	/src/zstd/lib/legacy/zstd_v03.c:2934
0	0	None	0	0	ZSTDv04_findFrameSizeInfoLegacy	call site: 00089	/src/zstd/lib/legacy/zstd_v04.c:3105

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

1

Reachable functions

52

Percentage of reachable functions covered

98.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/zstd_frame_info.c	1
lib/decompress/zstd_decompress.c	16
lib/decompress/../legacy/zstd_legacy.h	3
lib/legacy/../common/mem.h	8
lib/legacy/zstd_v05.c	5
lib/legacy/zstd_v06.c	11
lib/legacy/zstd_v07.c	11
lib/legacy/zstd_v01.c	5
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	6
lib/legacy/zstd_v03.c	6
lib/legacy/zstd_v04.c	6
lib/decompress/zstd_decompress_block.c	1
lib/decompress/../common/mem.h	3

Fuzzer: block_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	781	49.4%
gold	[1:9]	11	0.69%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	785	49.7%
All colors	1578	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1106	1108	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadZstdDictionary', 'MEM_readLE32.828', 'ZSTD_loadDictionaryContent']	1106	1108	ZSTD_compress_insertDictionary	call site: 00296	/src/zstd/lib/compress/zstd_compress.c:5081
339	339	2 : View List ['ZSTD_ldm_blockCompress', 'ZSTD_ldm_generateSequences']	339	343	ZSTD_buildSeqStore	call site: 00642	/src/zstd/lib/compress/zstd_compress.c:3264
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 00000	/src/zstd/lib/compress/zstdmt_compress.c:1030
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_6_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:434
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:434
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_0']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:447
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_1']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:434
20	20	1 : View List ['ZSTD_writeFrameHeader']	1656	2559	ZSTD_compressContinue_internal	call site: 00559	/src/zstd/lib/compress/zstd_compress.c:4683
15	15	3 : View List ['FSE_getMaxNbBits', 'FSE_initCState.2204', 'HUF_getNbBitsFromCTable']	15	34	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:158
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	15	573	ZSTD_resetCCtx_internal	call site: 00105	/src/zstd/lib/compress/zstd_compress.c:2114

Runtime coverage analysis

Covered functions

441

Functions that are reachable but not covered

163

Reachable functions

425

Percentage of reachable functions covered

61.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	108
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	32
lib/common/error_private.h	1
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
lib/compress/zstd_compress_internal.h	30
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	6
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/common/mem.h	16
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	5
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/common/zstd_common.c	1
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/mem.h	9
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	33
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/common/compiler.h	2
lib/decompress/../common/zstd_internal.h	2
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: stream_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	450	29.1%
gold	[1:9]	6	0.38%
yellow	[10:29]	21	1.36%
greenyellow	[30:49]	7	0.45%
lawngreen	50+	1060	68.6%
All colors	1544	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
52	56	2 : View List ['HUFv05_isError', 'HUFv05_decompress1X4_usingDTable']	52	56	ZSTDv05_decodeLiteralsBlock	call site: 00229	/src/zstd/lib/legacy/zstd_v05.c:2867
52	52	2 : View List ['HUFv06_decompress1X4_usingDTable', 'ERR_isError.5195']	52	52	ZSTDv06_decodeLiteralsBlock	call site: 00376	/src/zstd/lib/legacy/zstd_v06.c:3052
0	36	2 : View List ['ZSTDv07_decodeFrameHeader', 'ERR_isError.5515']	0	36	ZSTDv07_decompressContinue	call site: 00477	/src/zstd/lib/legacy/zstd_v07.c:3952
0	0	None	307	307	ZSTD_decompressSequencesLong	call site: 01363	/src/zstd/lib/decompress/zstd_decompress_block.c:1988
0	0	None	289	289	HUF_readStats_wksp	call site: 01212	/src/zstd/lib/common/entropy_common.c:334
0	0	None	228	228	ZSTD_decompressSequencesSplitLitBuffer	call site: 01446	/src/zstd/lib/decompress/zstd_decompress_block.c:1965
0	0	None	214	214	FSE_decompress_wksp_bmi2	call site: 01214	/src/zstd/lib/common/fse_decompress.c:305
0	0	None	167	167	HUF_decompress4X2_usingDTable_internal	call site: 01111	/src/zstd/lib/decompress/huf_decompress.c:1726
0	0	None	103	103	HUF_decompress4X1_usingDTable_internal	call site: 01168	/src/zstd/lib/decompress/huf_decompress.c:904
0	0	None	58	6425	ZSTD_decompressStream	call site: 00740	/src/zstd/lib/decompress/zstd_decompress.c:2136
0	0	None	58	6425	ZSTD_decompressStream	call site: 01013	/src/zstd/lib/decompress/zstd_decompress.c:2230
0	0	None	58	6425	ZSTD_decompressStream	call site: 01017	/src/zstd/lib/decompress/zstd_decompress.c:2250

Runtime coverage analysis

Covered functions

529

Functions that are reachable but not covered

31

Reachable functions

396

Percentage of reachable functions covered

92.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_decompress.c	3
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	39
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	2
lib/common/cpu.h	2
lib/decompress/zstd_ddict.c	4
lib/common/zstd_common.c	1
lib/common/error_private.h	1
lib/legacy/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	5
lib/legacy/zstd_v04.c	61
lib/legacy/zstd_v05.c	67
lib/legacy/../common/mem.h	11
lib/legacy/zstd_v06.c	73
lib/legacy/zstd_v07.c	83
lib/common/xxhash.h	11
lib/legacy/zstd_v01.c	5
lib/legacy/zstd_v02.c	6
lib/legacy/zstd_v03.c	6
lib/decompress/zstd_decompress_block.c	29
lib/decompress/../common/mem.h	9
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	33
lib/common/bitstream.h	4
lib/common/mem.h	8
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/common/compiler.h	2
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/fse.h	1
lib/decompress/../common/zstd_internal.h	2

Fuzzer: seekable_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2009	64.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	0.15%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1123	35.7%
All colors	3137	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2763	2797	4 : View List ['ZSTD_CCtx_reset', 'ZSTDMT_compressStream_generic', 'ZSTDMT_updateCParams_whileCompressing', 'ZSTD_CCtx_trace']	2763	2800	ZSTD_compressStream2	call site: 00855	/src/zstd/lib/compress/zstd_compress.c:6355
1400	1400	3 : View List ['ZSTDMT_createCCtx_advanced', 'ZSTDMT_initCStream_internal', 'ZSTD_trace_compress_begin']	1400	1400	ZSTD_CCtx_init_compressStream2	call site: 00595	/src/zstd/lib/compress/zstd_compress.c:6262
1106	1108	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadZstdDictionary', 'MEM_readLE32.828', 'ZSTD_loadDictionaryContent']	1106	1108	ZSTD_compress_insertDictionary	call site: 00330	/src/zstd/lib/compress/zstd_compress.c:5081
777	777	1 : View List ['ZSTD_createCDict_advanced2']	777	777	ZSTD_initLocalDict	call site: 00173	/src/zstd/lib/compress/zstd_compress.c:1246
385	385	1 : View List ['ZSTD_compressBlock_fast_extDict_4_0']	385	385	ZSTD_compressBlock_fast_extDict	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:956
385	385	1 : View List ['ZSTD_compressBlock_fast_extDict_5_0']	385	385	ZSTD_compressBlock_fast_extDict	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:956
339	339	2 : View List ['ZSTD_ldm_blockCompress', 'ZSTD_ldm_generateSequences']	339	343	ZSTD_buildSeqStore	call site: 01087	/src/zstd/lib/compress/zstd_compress.c:3264
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 00049	/src/zstd/lib/compress/zstdmt_compress.c:1030
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_1']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:434
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_1']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:434

Runtime coverage analysis

Covered functions

576

Functions that are reachable but not covered

479

Reachable functions

873

Percentage of reachable functions covered

45.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/seekable_roundtrip.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	138
tests/fuzz/../../contrib/seekable_format/zstdseek_compress.c	12
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	1
lib/common/zstd_common.c	1
lib/compress/zstdmt_compress.c	51
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
tests/fuzz/../../contrib/seekable_format/zstdseek_decompress.c	7
lib/decompress/zstd_decompress.c	36
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	2
lib/common/xxhash.h	11
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/common/mem.h	17
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	5
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	4
lib/legacy/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	5
lib/legacy/zstd_v04.c	61
lib/legacy/zstd_v05.c	67
lib/legacy/../common/mem.h	11
lib/legacy/zstd_v06.c	73
lib/legacy/zstd_v07.c	83
lib/legacy/zstd_v01.c	5
lib/legacy/zstd_v02.c	6
lib/legacy/zstd_v03.c	6
lib/decompress/zstd_decompress_block.c	29
lib/decompress/../common/mem.h	9
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	33
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/common/compiler.h	2
lib/decompress/../common/zstd_internal.h	2

Fuzzer: dictionary_loader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	942	53.4%
gold	[1:9]	4	0.22%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.05%
lawngreen	50+	815	46.2%
All colors	1762	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2763	2797	4 : View List ['ZSTD_CCtx_reset', 'ZSTDMT_compressStream_generic', 'ZSTDMT_updateCParams_whileCompressing', 'ZSTD_CCtx_trace']	2763	2800	ZSTD_compressStream2	call site: 00830	/src/zstd/lib/compress/zstd_compress.c:6355
1400	1400	3 : View List ['ZSTDMT_createCCtx_advanced', 'ZSTDMT_initCStream_internal', 'ZSTD_trace_compress_begin']	1400	1400	ZSTD_CCtx_init_compressStream2	call site: 00474	/src/zstd/lib/compress/zstd_compress.c:6262
339	339	2 : View List ['ZSTD_ldm_blockCompress', 'ZSTD_ldm_generateSequences']	339	343	ZSTD_buildSeqStore	call site: 01062	/src/zstd/lib/compress/zstd_compress.c:3264
316	316	1 : View List ['ZSTD_compressBlock_doubleFast_extDict_6']	316	316	ZSTD_compressBlock_doubleFast_extDict	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:756
316	316	1 : View List ['ZSTD_compressBlock_doubleFast_extDict_7']	316	316	ZSTD_compressBlock_doubleFast_extDict	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:756
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 00589	/src/zstd/lib/compress/zstdmt_compress.c:1030
126	126	5 : View List ['ZSTD_NCountCost', 'ERR_isError.1039', 'ZSTD_crossEntropyCost', 'ZSTD_entropyCost', 'ZSTD_fseBitCost']	126	126	ZSTD_selectEncodingType	call site: 01217	/src/zstd/lib/compress/zstd_compress_sequences.c:179
119	119	1 : View List ['ZSTD_compressBlock_doubleFast_dictMatchState_6']	119	119	ZSTD_compressBlock_doubleFast_dictMatchState	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:585
119	119	1 : View List ['ZSTD_compressBlock_doubleFast_dictMatchState_7']	119	119	ZSTD_compressBlock_doubleFast_dictMatchState	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:585
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_6']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
95	95	1 : View List ['ZSTD_compressBlock_doubleFast_noDict_7']	95	95	ZSTD_compressBlock_doubleFast	call site: 00000	/src/zstd/lib/compress/zstd_double_fast.c:565
57	66	2 : View List ['ZSTD_ldm_fillHashTable', 'ZSTD_window_update']	302	418	ZSTD_loadDictionaryContent	call site: 00226	/src/zstd/lib/compress/zstd_compress.c:4831

Runtime coverage analysis

Covered functions

443

Functions that are reachable but not covered

227

Reachable functions

544

Percentage of reachable functions covered

58.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_loader.c	3
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	131
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	1
lib/common/zstd_common.c	1
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	11
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/common/mem.h	15
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstdmt_compress.c	50
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	12
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
lib/decompress/zstd_ddict.c	4
lib/legacy/../common/mem.h	2
lib/decompress/huf_decompress.c	8
lib/decompress/../common/error_private.h	1
lib/legacy/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	3
lib/decompress/../common/mem.h	1
lib/decompress/../common/bits.h	2
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: decompress_dstSize_tooSmall

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	657	52.3%
gold	[1:9]	1	0.07%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	595	47.4%
All colors	1254	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1106	1108	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadZstdDictionary', 'MEM_readLE32.828', 'ZSTD_loadDictionaryContent']	1106	1108	ZSTD_compress_insertDictionary	call site: 00292	/src/zstd/lib/compress/zstd_compress.c:5081
339	339	2 : View List ['ZSTD_ldm_blockCompress', 'ZSTD_ldm_generateSequences']	339	343	ZSTD_buildSeqStore	call site: 00633	/src/zstd/lib/compress/zstd_compress.c:3264
314	314	4 : View List ['ZSTD_compressBlock_fast_noDict_5_1', 'ZSTD_compressBlock_fast_noDict_7_1', 'ZSTD_compressBlock_fast_noDict_6_1', 'ZSTD_compressBlock_fast_noDict_4_1']	314	314	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:433
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 01189	/src/zstd/lib/compress/zstdmt_compress.c:1030
126	126	5 : View List ['ZSTD_NCountCost', 'ERR_isError.1039', 'ZSTD_crossEntropyCost', 'ZSTD_entropyCost', 'ZSTD_fseBitCost']	126	126	ZSTD_selectEncodingType	call site: 00824	/src/zstd/lib/compress/zstd_compress_sequences.c:179
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_0']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:447
12	329	6 : View List ['HUF_writeCTable_wksp', 'ERR_isError.747', 'HUF_estimateCompressedSize', 'HUF_cardinality', 'HUF_buildCTable_wksp', 'HUF_minTableLog']	12	329	HUF_optimalTableLog	call site: 00729	/src/zstd/lib/compress/huf_compress.c:1284
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	11	573	ZSTD_resetCCtx_internal	call site: 00101	/src/zstd/lib/compress/zstd_compress.c:2114
7	7	1 : View List ['ZSTD_ldm_skipRawSeqStoreBytes']	7	7	ZSTD_buildSeqStore	call site: 00594	/src/zstd/lib/compress/zstd_compress.c:3212
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2521	ZSTD_compressContinue_internal	call site: 00567	/src/zstd/lib/compress/zstd_compress.c:4703
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.817']	25	55	ZSTD_writeEpilogue	call site: 01147	/src/zstd/lib/compress/zstd_compress.c:5228
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00711	/src/zstd/lib/compress/hist.c:160

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

167

Reachable functions

423

Percentage of reachable functions covered

60.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_dstSize_tooSmall.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	110
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	32
lib/common/error_private.h	2
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
lib/compress/zstd_compress_internal.h	30
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	11
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/common/mem.h	15
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	2
lib/decompress/zstd_ddict.c	1
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: simple_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	513	26.3%
gold	[1:9]	2	0.10%
yellow	[10:29]	3	0.15%
greenyellow	[30:49]	1	0.05%
lawngreen	50+	1430	73.3%
All colors	1949	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
777	777	1 : View List ['ZSTD_createCDict_advanced2']	777	777	ZSTD_initLocalDict	call site: 00199	/src/zstd/lib/compress/zstd_compress.c:1246
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.828']	518	812	ZSTD_compress_insertDictionary	call site: 00336	/src/zstd/lib/compress/zstd_compress.c:5089
57	66	2 : View List ['ZSTD_ldm_fillHashTable', 'ZSTD_window_update']	109	418	ZSTD_loadDictionaryContent	call site: 00352	/src/zstd/lib/compress/zstd_compress.c:4831
40	40	1 : View List ['ZSTD_fillDoubleHashTableForCDict']	40	40	ZSTD_fillDoubleHashTable	call site: 00403	/src/zstd/lib/compress/zstd_double_fast.c:95
36	36	1 : View List ['ZSTD_fillHashTableForCDict']	36	36	ZSTD_fillHashTable	call site: 00387	/src/zstd/lib/compress/zstd_fast.c:92
15	15	3 : View List ['FSE_getMaxNbBits', 'FSE_initCState.2204', 'HUF_getNbBitsFromCTable']	15	34	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:158
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	793	989	ZSTDMT_initCStream_internal	call site: 00732	/src/zstd/lib/compress/zstdmt_compress.c:1255
6	6	1 : View List ['ZSTD_window_isEmpty']	115	433	ZSTD_loadDictionaryContent	call site: 00347	/src/zstd/lib/compress/zstd_compress.c:4822
2	2	1 : View List ['ZSTD_errorFrameSizeInfo']	2	2	ZSTD_findFrameSizeInfo	call site: 01912	/src/zstd/lib/decompress/zstd_decompress.c:785
0	87	1 : View List ['ZSTD_freeCCtx']	2	89	ZSTDMT_releaseCCtx	call site: 01662	/src/zstd/lib/compress/zstdmt_compress.c:454
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 01146	/src/zstd/lib/compress/zstd_compress.c:3315
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2521	ZSTD_compressContinue_internal	call site: 01082	/src/zstd/lib/compress/zstd_compress.c:4703

Runtime coverage analysis

Covered functions

684

Functions that are reachable but not covered

102

Reachable functions

565

Percentage of reachable functions covered

81.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_round_trip.c	3
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	142
tests/fuzz/fuzz_data_producer.c	8
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	1
lib/decompress/zstd_decompress.c	20
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
tests/fuzz/zstd_helpers.c	6
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/common/zstd_common.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/common/mem.h	15
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	11
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstdmt_compress.c	50
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/legacy/../common/error_private.h	1
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	3
lib/legacy/../common/mem.h	8
lib/legacy/zstd_v01.c	5
lib/legacy/zstd_v02.c	6
lib/legacy/zstd_v03.c	6
lib/legacy/zstd_v04.c	9
lib/legacy/zstd_v05.c	6
lib/legacy/zstd_v06.c	8
lib/legacy/zstd_v07.c	8
lib/decompress/zstd_decompress_block.c	1
lib/decompress/../common/mem.h	3

Fuzzer: huf_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	94	33.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	189	66.7%
All colors	283	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	9	FUZZ_dataProducer_int32Range	call site: 00005	/src/zstd/tests/fuzz/fuzz_data_producer.c:60

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

5

Reachable functions

84

Percentage of reachable functions covered

94.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/common/cpu.h	1
lib/decompress/huf_decompress.c	28
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	8
lib/common/bits.h	3
lib/common/error_private.h	1
lib/common/bitstream.h	3
lib/common/fse.h	1
lib/decompress/../common/error_private.h	1
lib/common/zstd_common.c	1
lib/decompress/../common/bits.h	3
lib/common/compiler.h	1

Fuzzer: simple_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	64	31.8%
gold	[1:9]	7	3.48%
yellow	[10:29]	6	2.98%
greenyellow	[30:49]	9	4.47%
lawngreen	50+	115	57.2%
All colors	201	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
52	56	2 : View List ['HUFv05_isError', 'HUFv05_decompress1X4_usingDTable']	52	56	ZSTDv05_decodeLiteralsBlock	call site: 00000	/src/zstd/lib/legacy/zstd_v05.c:2867
52	52	2 : View List ['HUFv06_decompress1X4_usingDTable', 'ERR_isError.5195']	52	52	ZSTDv06_decodeLiteralsBlock	call site: 00000	/src/zstd/lib/legacy/zstd_v06.c:3052
2	2	1 : View List ['ZSTD_errorFrameSizeInfo']	2	2	ZSTD_findFrameSizeInfo	call site: 00177	/src/zstd/lib/decompress/zstd_decompress.c:785
0	14	3 : View List ['ZSTDv05_copy8', 'ZSTDv05_wildcopy', 'ZSTDv05_copy4']	0	14	ZSTDv05_execSequence	call site: 00000	/src/zstd/lib/legacy/zstd_v05.c:3204
0	14	3 : View List ['ZSTDv06_wildcopy', 'ZSTDv06_copy4', 'ZSTDv06_copy8']	0	14	ZSTDv06_execSequence	call site: 00000	/src/zstd/lib/legacy/zstd_v06.c:3336
0	14	3 : View List ['ZSTDv07_copy4', 'ZSTDv07_wildcopy', 'ZSTDv07_copy8']	0	14	ZSTDv07_execSequence	call site: 00000	/src/zstd/lib/legacy/zstd_v07.c:3561
0	0	None	289	289	HUF_readStats_wksp	call site: 00000	/src/zstd/lib/common/entropy_common.c:334
0	0	None	228	228	ZSTD_decompressSequencesSplitLitBuffer	call site: 00000	/src/zstd/lib/decompress/zstd_decompress_block.c:1965
0	0	None	214	214	FSE_decompress_wksp_bmi2	call site: 00000	/src/zstd/lib/common/fse_decompress.c:305
0	0	None	167	167	HUF_decompress4X2_usingDTable_internal	call site: 00000	/src/zstd/lib/decompress/huf_decompress.c:1726
0	0	None	103	103	HUF_decompress4X1_usingDTable_internal	call site: 00000	/src/zstd/lib/decompress/huf_decompress.c:904
0	0	None	27	27	ZSTD_buildFSETable	call site: 00000	/src/zstd/lib/decompress/zstd_decompress_block.c:632

Runtime coverage analysis

Covered functions

462

Functions that are reachable but not covered

6

Reachable functions

90

Percentage of reachable functions covered

93.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	20
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
lib/common/cpu.h	2
lib/decompress/zstd_ddict.c	1
lib/common/zstd_common.c	1
lib/common/error_private.h	1
lib/legacy/../common/mem.h	8
lib/legacy/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	4
lib/legacy/zstd_v05.c	7
lib/legacy/zstd_v06.c	13
lib/legacy/zstd_v07.c	13
lib/legacy/zstd_v01.c	5
lib/legacy/zstd_v02.c	6
lib/legacy/zstd_v03.c	6
lib/legacy/zstd_v04.c	9
lib/decompress/zstd_decompress_block.c	1
lib/decompress/../common/mem.h	3

Fuzzer: huf_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	118	24.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	4	0.84%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	353	74.3%
All colors	475	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00022	/src/zstd/lib/compress/hist.c:160
0	0	None	0	9	FUZZ_dataProducer_int32Range	call site: 00005	/src/zstd/tests/fuzz/fuzz_data_producer.c:60
0	0	None	0	0	FSE_buildDTable_internal	call site: 00171	/src/zstd/lib/common/fse_decompress.c:92
0	0	None	0	0	FSE_buildCTable_wksp	call site: 00125	/src/zstd/lib/compress/fse_compress.c:104
0	0	None	0	0	FSE_buildCTable_wksp	call site: 00127	/src/zstd/lib/compress/fse_compress.c:116
0	0	None	0	0	FSE_normalizeM2	call site: 00114	/src/zstd/lib/compress/fse_compress.c:415
0	0	None	0	0	FSE_normalizeM2	call site: 00114	/src/zstd/lib/compress/fse_compress.c:428
0	0	None	0	0	FSE_normalizeM2	call site: 00114	/src/zstd/lib/compress/fse_compress.c:439
0	0	None	0	0	HIST_count_parallel_wksp	call site: 00024	/src/zstd/lib/compress/hist.c:83

Runtime coverage analysis

Covered functions

175

Functions that are reachable but not covered

9

Reachable functions

154

Percentage of reachable functions covered

94.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/common/cpu.h	1
lib/compress/hist.c	5
lib/compress/../common/mem.h	1
lib/common/zstd_common.c	1
lib/common/error_private.h	2
lib/common/bits.h	3
lib/compress/huf_compress.c	27
lib/compress/fse_compress.c	10
lib/compress/../common/bits.h	2
lib/compress/../common/error_private.h	1
lib/common/mem.h	12
lib/decompress/huf_decompress.c	28
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/bitstream.h	3
lib/common/fse.h	1
lib/decompress/../common/error_private.h	1
lib/decompress/../common/bits.h	3
lib/common/compiler.h	1

Fuzzer: generate_sequences

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	768	41.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.05%
greenyellow	[30:49]	1	0.05%
lawngreen	50+	1063	57.9%
All colors	1833	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2763	2797	4 : View List ['ZSTD_CCtx_reset', 'ZSTDMT_compressStream_generic', 'ZSTDMT_updateCParams_whileCompressing', 'ZSTD_CCtx_trace']	2763	2800	ZSTD_compressStream2	call site: 00908	/src/zstd/lib/compress/zstd_compress.c:6355
1400	1400	3 : View List ['ZSTDMT_createCCtx_advanced', 'ZSTDMT_initCStream_internal', 'ZSTD_trace_compress_begin']	1400	1400	ZSTD_CCtx_init_compressStream2	call site: 00594	/src/zstd/lib/compress/zstd_compress.c:6262
1106	1108	4 : View List ['ZSTD_reset_compressedBlockState', 'ZSTD_loadZstdDictionary', 'MEM_readLE32.828', 'ZSTD_loadDictionaryContent']	1106	1108	ZSTD_compress_insertDictionary	call site: 00339	/src/zstd/lib/compress/zstd_compress.c:5081
777	777	1 : View List ['ZSTD_createCDict_advanced2']	777	777	ZSTD_initLocalDict	call site: 00203	/src/zstd/lib/compress/zstd_compress.c:1246
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 00667	/src/zstd/lib/compress/zstdmt_compress.c:1030
40	40	1 : View List ['ZSTD_fillDoubleHashTableForCDict']	40	40	ZSTD_fillDoubleHashTable	call site: 00407	/src/zstd/lib/compress/zstd_double_fast.c:95
36	36	1 : View List ['ZSTD_fillHashTableForCDict']	36	36	ZSTD_fillHashTable	call site: 00391	/src/zstd/lib/compress/zstd_fast.c:92
15	15	3 : View List ['FSE_getMaxNbBits', 'FSE_initCState.2204', 'HUF_getNbBitsFromCTable']	15	34	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:158
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 01151	/src/zstd/lib/compress/zstd_compress.c:3315
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2521	ZSTD_compressContinue_internal	call site: 01087	/src/zstd/lib/compress/zstd_compress.c:4703
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:306
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.817']	0	55	ZSTD_writeEpilogue	call site: 01629	/src/zstd/lib/compress/zstd_compress.c:5228

Runtime coverage analysis

Covered functions

586

Functions that are reachable but not covered

166

Reachable functions

532

Percentage of reachable functions covered

68.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/generate_sequences.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	145
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	2
tests/fuzz/zstd_helpers.c	6
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/common/zstd_common.c	2
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/common/mem.h	15
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	11
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstdmt_compress.c	50
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: dictionary_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1195	40.0%
gold	[1:9]	9	0.30%
yellow	[10:29]	12	0.40%
greenyellow	[30:49]	6	0.20%
lawngreen	50+	1762	59.0%
All colors	2984	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.828']	518	812	ZSTD_compress_insertDictionary	call site: 00250	/src/zstd/lib/compress/zstd_compress.c:5089
339	339	2 : View List ['ZSTD_ldm_blockCompress', 'ZSTD_ldm_generateSequences']	339	343	ZSTD_buildSeqStore	call site: 00743	/src/zstd/lib/compress/zstd_compress.c:3264
314	314	4 : View List ['ZSTD_compressBlock_fast_noDict_5_1', 'ZSTD_compressBlock_fast_noDict_7_1', 'ZSTD_compressBlock_fast_noDict_6_1', 'ZSTD_compressBlock_fast_noDict_4_1']	314	314	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:433
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 01300	/src/zstd/lib/compress/zstdmt_compress.c:1030
126	126	5 : View List ['ZSTD_NCountCost', 'ERR_isError.1039', 'ZSTD_crossEntropyCost', 'ZSTD_entropyCost', 'ZSTD_fseBitCost']	126	126	ZSTD_selectEncodingType	call site: 00934	/src/zstd/lib/compress/zstd_compress_sequences.c:179
101	101	1 : View List ['ZSTD_compressBlock_fast_dictMatchState_7_0']	101	101	ZSTD_compressBlock_fast_dictMatchState	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:675
99	99	1 : View List ['ZSTD_compressBlock_fast_dictMatchState_4_0']	99	99	ZSTD_compressBlock_fast_dictMatchState	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:675
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_6_0']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:447
79	79	1 : View List ['ZSTD_compressBlock_fast_noDict_7_0']	79	79	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:447
77	77	1 : View List ['ZSTD_compressBlock_fast_noDict_4_0']	77	77	ZSTD_compressBlock_fast	call site: 00000	/src/zstd/lib/compress/zstd_fast.c:447
57	66	2 : View List ['ZSTD_ldm_fillHashTable', 'ZSTD_window_update']	309	418	ZSTD_loadDictionaryContent	call site: 00266	/src/zstd/lib/compress/zstd_compress.c:4831
52	56	2 : View List ['HUFv05_isError', 'HUFv05_decompress1X4_usingDTable']	52	56	ZSTDv05_decodeLiteralsBlock	call site: 01993	/src/zstd/lib/legacy/zstd_v05.c:2867

Runtime coverage analysis

Covered functions

741

Functions that are reachable but not covered

163

Reachable functions

738

Percentage of reachable functions covered

77.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
lib/common/cpu.h	2
tests/fuzz/zstd_helpers.c	1
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/common/mem.h	16
lib/common/error_private.h	2
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	11
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress.c	119
lib/compress/zstd_compress_internal.h	30
lib/compress/../common/bits.h	5
lib/compress/zstd_cwksp.h	33
lib/compress/../common/allocations.h	2
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	5
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/../common/zstd_internal.h	3
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/common/zstd_common.c	2
lib/decompress/zstd_ddict.c	9
lib/legacy/../common/mem.h	11
lib/decompress/huf_decompress.c	33
lib/decompress/../common/error_private.h	1
lib/legacy/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	29
lib/decompress/../common/mem.h	9
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	50
lib/legacy/zstd_v02.c	43
lib/legacy/zstd_v03.c	43
lib/legacy/zstd_v04.c	51
lib/legacy/zstd_v05.c	63
lib/legacy/zstd_v06.c	69
lib/legacy/zstd_v07.c	79
lib/decompress/zstd_decompress_internal.h	1
lib/common/compiler.h	2
lib/decompress/../common/zstd_internal.h	2

Fuzzer: sequence_compression_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	311	43.7%
gold	[1:9]	65	9.14%
yellow	[10:29]	2	0.28%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	333	46.8%
All colors	711	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1400	1400	3 : View List ['ZSTDMT_createCCtx_advanced', 'ZSTDMT_initCStream_internal', 'ZSTD_trace_compress_begin']	1400	1400	ZSTD_CCtx_init_compressStream2	call site: 00000	/src/zstd/lib/compress/zstd_compress.c:6262
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.828']	518	812	ZSTD_compress_insertDictionary	call site: 00257	/src/zstd/lib/compress/zstd_compress.c:5089
431	431	3 : View List ['MEM_readLE32.2770', 'ZSTD_loadDEntropy', 'ERR_isError.2771']	431	431	ZSTD_loadEntropy_intoDDict	call site: 00517	/src/zstd/lib/decompress/zstd_ddict.c:95
209	222	9 : View List ['ZSTDMT_freeBufferPool', 'ZSTD_customFree.2466', 'ZSTDMT_releaseAllJobResources', 'ZSTDMT_freeJobsTable', 'ZSTDMT_freeSeqPool', 'ZSTDMT_freeCCtxPool', 'POOL_free', 'ZSTD_freeCDict', 'ZSTDMT_serialState_free']	209	222	ZSTDMT_freeCCtx	call site: 00646	/src/zstd/lib/compress/zstdmt_compress.c:1030
78	78	3 : View List ['ZSTD_createDDictHashSet', 'ERR_isError.3033', 'ZSTD_DDictHashSet_addDDict']	78	78	ZSTD_DCtx_refDDict	call site: 00601	/src/zstd/lib/decompress/zstd_decompress.c:1785
57	66	2 : View List ['ZSTD_ldm_fillHashTable', 'ZSTD_window_update']	309	418	ZSTD_loadDictionaryContent	call site: 00273	/src/zstd/lib/compress/zstd_compress.c:4831
35	35	1 : View List ['ZSTD_fillHashTableForCCtx']	35	35	ZSTD_fillHashTable	call site: 00309	/src/zstd/lib/compress/zstd_fast.c:92
34	34	2 : View List ['ZSTD_compressRleLiteralsBlock', 'allBytesIdentical']	34	34	ZSTD_compressLiterals	call site: 00000	/src/zstd/lib/compress/zstd_compress_literals.c:192
11	11	1 : View List ['ZSTD_ldm_adjustParameters']	11	573	ZSTD_resetCCtx_internal	call site: 00000	/src/zstd/lib/compress/zstd_compress.c:2114
6	6	1 : View List ['ZSTD_window_isEmpty']	315	433	ZSTD_loadDictionaryContent	call site: 00268	/src/zstd/lib/compress/zstd_compress.c:4822
0	777	1 : View List ['ZSTD_createCDict_advanced2']	0	777	ZSTD_initLocalDict	call site: 00000	/src/zstd/lib/compress/zstd_compress.c:1246
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00000	/src/zstd/lib/compress/hist.c:160

Runtime coverage analysis

Covered functions

421

Functions that are reachable but not covered

145

Reachable functions

416

Percentage of reachable functions covered

65.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/sequence_compression_api.c	6
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	53
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	1
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	23
lib/common/error_private.h	2
lib/decompress/zstd_decompress.c	16
lib/decompress/../common/allocations.h	3
lib/legacy/../common/zstd_internal.h	1
lib/compress/zstd_compress_internal.h	17
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	5
lib/common/xxhash.h	3
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	4
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/common/mem.h	8
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	4
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	2
lib/common/fse.h	1
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	1
lib/decompress/zstd_ddict.c	5
lib/legacy/../common/mem.h	2
lib/decompress/huf_decompress.c	8
lib/decompress/../common/error_private.h	1
lib/legacy/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	3
lib/decompress/../common/mem.h	1
lib/decompress/../common/bits.h	2
lib/common/zstd_common.c	2
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	293	14.5%
gold	[1:9]	2	0.09%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	3	0.14%
lawngreen	50+	1712	85.1%
All colors	2011	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	12	989	ZSTDMT_initCStream_internal	call site: 01648	/src/zstd/lib/compress/zstdmt_compress.c:1255
6	6	1 : View List ['ZSTD_window_isEmpty']	6	433	ZSTD_loadDictionaryContent	call site: 00285	/src/zstd/lib/compress/zstd_compress.c:4822
4	4	2 : View List ['fflush', 'fwrite']	4	104	ZDICT_analyzeEntropy	call site: 01296	/src/zstd/lib/dictBuilder/zdict.c:819
0	87	1 : View List ['ZSTD_freeCCtx']	2	89	ZSTDMT_releaseCCtx	call site: 01837	/src/zstd/lib/compress/zstdmt_compress.c:454
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 00791	/src/zstd/lib/compress/zstd_compress.c:3315
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:306
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.817']	25	55	ZSTD_writeEpilogue	call site: 01379	/src/zstd/lib/compress/zstd_compress.c:5228
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00828	/src/zstd/lib/compress/hist.c:160
0	17	1 : View List ['ZSTDMT_freeBufferPool']	0	17	ZSTDMT_createBufferPool	call site: 01597	/src/zstd/lib/compress/zstdmt_compress.c:132
0	3	1 : View List ['FASTCOVER_ctx_destroy']	4	7	FASTCOVER_ctx_init	call site: 00066	/src/zstd/lib/dictBuilder/fastcover.c:383
0	3	1 : View List ['ZSTD_rollingHash_append']	0	20	findSynchronizationPoint	call site: 01725	/src/zstd/lib/compress/zstdmt_compress.c:1742
0	0	None	307	307	ZSTD_decompressSequencesLong	call site: 00000	/src/zstd/lib/decompress/zstd_decompress_block.c:1988

Runtime coverage analysis

Covered functions

849

Functions that are reachable but not covered

63

Reachable functions

595

Percentage of reachable functions covered

89.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	8
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	148
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	1
lib/decompress/zstd_decompress.c	12
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/common/mem.h	15
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	11
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	50
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	4
lib/legacy/../common/mem.h	2
lib/decompress/huf_decompress.c	8
lib/decompress/../common/error_private.h	1
lib/legacy/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	3
lib/decompress/../common/mem.h	1
lib/decompress/../common/bits.h	2
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: dictionary_stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	205	10.2%
gold	[1:9]	5	0.25%
yellow	[10:29]	1	0.05%
greenyellow	[30:49]	1	0.05%
lawngreen	50+	1783	89.3%
All colors	1995	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	12	989	ZSTDMT_initCStream_internal	call site: 01607	/src/zstd/lib/compress/zstdmt_compress.c:1255
6	6	1 : View List ['ZSTD_window_isEmpty']	6	433	ZSTD_loadDictionaryContent	call site: 00283	/src/zstd/lib/compress/zstd_compress.c:4822
4	4	2 : View List ['fflush', 'fwrite']	4	104	ZDICT_analyzeEntropy	call site: 01295	/src/zstd/lib/dictBuilder/zdict.c:819
0	87	1 : View List ['ZSTD_freeCCtx']	2	89	ZSTDMT_releaseCCtx	call site: 01818	/src/zstd/lib/compress/zstdmt_compress.c:454
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 00790	/src/zstd/lib/compress/zstd_compress.c:3315
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:306
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.817']	0	55	ZSTD_writeEpilogue	call site: 01782	/src/zstd/lib/compress/zstd_compress.c:5228
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 00827	/src/zstd/lib/compress/hist.c:160
0	17	1 : View List ['ZSTDMT_freeBufferPool']	0	17	ZSTDMT_createBufferPool	call site: 01556	/src/zstd/lib/compress/zstdmt_compress.c:132
0	3	1 : View List ['FASTCOVER_ctx_destroy']	4	7	FASTCOVER_ctx_init	call site: 00065	/src/zstd/lib/dictBuilder/fastcover.c:383
0	0	None	307	307	ZSTD_decompressSequencesLong	call site: 00000	/src/zstd/lib/decompress/zstd_decompress_block.c:1988
0	0	None	167	167	HUF_decompress4X2_usingDTable_internal	call site: 00000	/src/zstd/lib/decompress/huf_decompress.c:1726

Runtime coverage analysis

Covered functions

851

Functions that are reachable but not covered

49

Reachable functions

590

Percentage of reachable functions covered

91.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_stream_round_trip.c	4
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	144
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	1
lib/decompress/zstd_decompress.c	12
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/common/mem.h	15
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	11
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	50
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	4
lib/legacy/../common/mem.h	2
lib/decompress/huf_decompress.c	8
lib/decompress/../common/error_private.h	1
lib/legacy/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	3
lib/decompress/../common/mem.h	1
lib/decompress/../common/bits.h	2
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: decompress_cross_format

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1148	73.0%
gold	[1:9]	2	0.12%
yellow	[10:29]	4	0.25%
greenyellow	[30:49]	5	0.31%
lawngreen	50+	413	26.2%
All colors	1572	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	3662	6425	ZSTD_decompressStream	call site: 00188	/src/zstd/lib/decompress/zstd_decompress.c:2127
0	0	None	3662	6425	ZSTD_decompressStream	call site: 00867	/src/zstd/lib/decompress/zstd_decompress.c:2136
0	0	None	3662	6425	ZSTD_decompressStream	call site: 00877	/src/zstd/lib/decompress/zstd_decompress.c:2139
0	0	None	3662	6425	ZSTD_decompressStream	call site: 01014	/src/zstd/lib/decompress/zstd_decompress.c:2164
0	0	None	3662	6425	ZSTD_decompressStream	call site: 01031	/src/zstd/lib/decompress/zstd_decompress.c:2230
0	0	None	3662	6425	ZSTD_decompressStream	call site: 01035	/src/zstd/lib/decompress/zstd_decompress.c:2250
0	0	None	1745	2152	ZSTD_decompressMultiFrame	call site: 00000	/src/zstd/lib/decompress/zstd_decompress.c:1132
0	0	None	289	289	HUF_readStats_wksp	call site: 01233	/src/zstd/lib/common/entropy_common.c:334
0	0	None	228	228	ZSTD_decompressSequencesSplitLitBuffer	call site: 01467	/src/zstd/lib/decompress/zstd_decompress_block.c:1965
0	0	None	214	214	FSE_decompress_wksp_bmi2	call site: 01235	/src/zstd/lib/common/fse_decompress.c:305
0	0	None	167	167	HUF_decompress4X2_usingDTable_internal	call site: 01131	/src/zstd/lib/decompress/huf_decompress.c:1726
0	0	None	103	103	HUF_decompress4X1_usingDTable_internal	call site: 01189	/src/zstd/lib/decompress/huf_decompress.c:904

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

292

Reachable functions

387

Percentage of reachable functions covered

24.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_cross_format.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	40
lib/decompress/../legacy/zstd_legacy.h	5
lib/legacy/../common/mem.h	11
lib/legacy/zstd_v01.c	5
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	6
lib/legacy/zstd_v03.c	6
lib/legacy/zstd_v04.c	61
lib/legacy/zstd_v05.c	67
lib/legacy/zstd_v06.c	73
lib/legacy/zstd_v07.c	83
lib/decompress/zstd_decompress_block.c	29
lib/decompress/../common/mem.h	9
lib/common/zstd_common.c	1
lib/common/error_private.h	1
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	2
lib/common/cpu.h	2
lib/decompress/zstd_ddict.c	4
lib/common/xxhash.h	11
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	33
lib/common/bitstream.h	4
lib/common/mem.h	8
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/common/compiler.h	2
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/fse.h	1
lib/decompress/../common/zstd_internal.h	2

Fuzzer: raw_dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	335	18.1%
gold	[1:9]	2	0.10%
yellow	[10:29]	2	0.10%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1503	81.5%
All colors	1842	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.828']	518	812	ZSTD_compress_insertDictionary	call site: 00350	/src/zstd/lib/compress/zstd_compress.c:5089
431	431	3 : View List ['MEM_readLE32.2770', 'ZSTD_loadDEntropy', 'ERR_isError.2771']	431	431	ZSTD_loadEntropy_intoDDict	call site: 01758	/src/zstd/lib/decompress/zstd_ddict.c:95
15	15	3 : View List ['FSE_getMaxNbBits', 'FSE_initCState.2204', 'HUF_getNbBitsFromCTable']	15	34	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:158
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	12	989	ZSTDMT_initCStream_internal	call site: 00745	/src/zstd/lib/compress/zstdmt_compress.c:1255
6	6	1 : View List ['ZSTD_window_isEmpty']	6	433	ZSTD_loadDictionaryContent	call site: 00361	/src/zstd/lib/compress/zstd_compress.c:4822
0	87	1 : View List ['ZSTD_freeCCtx']	2	89	ZSTDMT_releaseCCtx	call site: 01675	/src/zstd/lib/compress/zstdmt_compress.c:454
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 01159	/src/zstd/lib/compress/zstd_compress.c:3315
0	56	1 : View List ['ZSTD_overflowCorrectIfNeeded']	0	2521	ZSTD_compressContinue_internal	call site: 01095	/src/zstd/lib/compress/zstd_compress.c:4703
0	25	1 : View List ['ZSTD_litLengthPrice']	0	25	ZSTD_litLengthPrice	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:306
0	20	2 : View List ['ZSTD_writeFrameHeader', 'ERR_isError.817']	25	55	ZSTD_writeEpilogue	call site: 01637	/src/zstd/lib/compress/zstd_compress.c:5228
0	17	1 : View List ['HIST_count_parallel_wksp']	0	17	HIST_count_wksp	call site: 01193	/src/zstd/lib/compress/hist.c:160
0	17	1 : View List ['ZSTDMT_freeBufferPool']	0	17	ZSTDMT_createBufferPool	call site: 00657	/src/zstd/lib/compress/zstdmt_compress.c:132

Runtime coverage analysis

Covered functions

798

Functions that are reachable but not covered

69

Reachable functions

557

Percentage of reachable functions covered

87.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/raw_dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	137
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	1
lib/decompress/zstd_decompress.c	12
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	1
tests/fuzz/zstd_helpers.c	6
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/common/zstd_common.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/common/mem.h	15
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	11
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	3
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstdmt_compress.c	50
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	4
lib/legacy/../common/mem.h	2
lib/decompress/huf_decompress.c	8
lib/decompress/../common/error_private.h	1
lib/legacy/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	3
lib/decompress/../common/mem.h	1
lib/decompress/../common/bits.h	2
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1470	46.1%
gold	[1:9]	1	0.03%
yellow	[10:29]	5	0.15%
greenyellow	[30:49]	7	0.21%
lawngreen	50+	1701	53.4%
All colors	3184	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
777	777	1 : View List ['ZSTD_createCDict_advanced2']	777	777	ZSTD_initLocalDict	call site: 00209	/src/zstd/lib/compress/zstd_compress.c:1246
518	518	2 : View List ['ZSTD_loadZstdDictionary', 'MEM_readLE32.828']	518	812	ZSTD_compress_insertDictionary	call site: 00346	/src/zstd/lib/compress/zstd_compress.c:5089
57	66	2 : View List ['ZSTD_ldm_fillHashTable', 'ZSTD_window_update']	109	418	ZSTD_loadDictionaryContent	call site: 00362	/src/zstd/lib/compress/zstd_compress.c:4831
40	40	1 : View List ['ZSTD_fillDoubleHashTableForCDict']	40	40	ZSTD_fillDoubleHashTable	call site: 00412	/src/zstd/lib/compress/zstd_double_fast.c:95
36	36	1 : View List ['ZSTD_fillHashTableForCDict']	36	36	ZSTD_fillHashTable	call site: 00397	/src/zstd/lib/compress/zstd_fast.c:92
15	15	3 : View List ['FSE_getMaxNbBits', 'FSE_initCState.2204', 'HUF_getNbBitsFromCTable']	15	34	ZSTD_rescaleFreqs	call site: 00000	/src/zstd/lib/compress/zstd_opt.c:158
12	27	2 : View List ['ZSTDMT_waitForAllJobsCompleted', 'ZSTDMT_releaseAllJobResources']	793	989	ZSTDMT_initCStream_internal	call site: 00741	/src/zstd/lib/compress/zstdmt_compress.c:1255
6	6	1 : View List ['ZSTD_window_isEmpty']	115	433	ZSTD_loadDictionaryContent	call site: 00357	/src/zstd/lib/compress/zstd_compress.c:4822
4	4	1 : View List ['ZSTD_nextInputType']	4	4	ZSTD_decompressStream	call site: 03150	/src/zstd/lib/decompress/zstd_decompress.c:2364
2	2	1 : View List ['ZSTD_errorFrameSizeInfo']	2	2	ZSTD_findFrameSizeInfo	call site: 02699	/src/zstd/lib/decompress/zstd_decompress.c:785
0	87	1 : View List ['ZSTD_freeCCtx']	2	89	ZSTDMT_releaseCCtx	call site: 01671	/src/zstd/lib/compress/zstdmt_compress.c:454
0	59	1 : View List ['ZSTD_selectBlockCompressor']	0	61	ZSTD_buildSeqStore	call site: 01155	/src/zstd/lib/compress/zstd_compress.c:3315

Runtime coverage analysis

Covered functions

737

Functions that are reachable but not covered

339

Reachable functions

835

Percentage of reachable functions covered

59.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_round_trip.c	5
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	135
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/common/cpu.h	2
lib/compress/zstd_cwksp.h	33
lib/common/error_private.h	1
lib/decompress/zstd_decompress.c	40
lib/decompress/../common/allocations.h	2
lib/legacy/../common/zstd_internal.h	2
tests/fuzz/zstd_helpers.c	6
lib/compress/zstd_compress_internal.h	34
lib/compress/../common/bits.h	5
lib/common/zstd_common.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/common/mem.h	16
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	11
lib/compress/zstd_fast.c	3
lib/compress/../common/mem.h	6
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	3
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	29
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/bits.h	3
lib/common/bitstream.h	5
lib/common/fse.h	4
lib/compress/../common/error_private.h	1
lib/compress/fse_compress.c	11
lib/compress/zstdmt_compress.c	50
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_superblock.c	13
lib/compress/hist.c	4
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/legacy/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	5
lib/legacy/zstd_v04.c	61
lib/legacy/zstd_v05.c	67
lib/legacy/../common/mem.h	11
lib/legacy/zstd_v06.c	73
lib/legacy/zstd_v07.c	83
lib/decompress/zstd_ddict.c	4
lib/legacy/zstd_v01.c	5
lib/legacy/zstd_v02.c	6
lib/legacy/zstd_v03.c	6
lib/decompress/zstd_decompress_block.c	29
lib/decompress/../common/mem.h	9
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	33
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/common/compiler.h	2
lib/decompress/../common/zstd_internal.h	2