High level conclusions

Fuzzers reach 66.24% code coverage.

Fuzzers reach 31.69% of cyclomatic complexity.

Fuzzers reach 58.49% of all functions.

Fuzzer decompress_cross_format is blocked:

The runtime code coverage of decompress_cross_format covers 25.44% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1019 / 1742

Cyclomatic complexity statically reachable by fuzzers

7289 / 22996

Runtime code coverage of functions

1154 / 1742

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: block_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	293	48.9%
gold	[1:9]	3	0.50%
yellow	[10:29]	1	0.16%
greenyellow	[30:49]	1	0.16%
lawngreen	50+	300	50.1%
All colors	598	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	83	BIT_lookBitsFast	call site: 00083	HUF_decompress4X_usingDTable
40	473	ZSTD_execSequenceEndSplitLitBuffer	call site: 00473	ZSTD_decompressSequencesLong_default
29	400	BIT_readBitsFast	call site: 00400	BIT_reloadDStream_internal
19	253	BIT_readBitsFast	call site: 00253	FSE_decompress_wksp_body_default
18	451	ZSTD_execSequenceEnd	call site: 00451	ZSTD_execSequenceEndSplitLitBuffer
13	380	ZSTD_decompressBlock_internal	call site: 00380	ZSTD_decompressSequencesLong
13	583	ZSTD_freeDCtx	call site: 00583	ZSTD_freeLegacyStreamContext
12	530	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00530	ZSTD_execSequenceEnd
8	7	FUZZ_malloc_rand	call site: 00007	FUZZ_dataProducer_int32Range
8	521	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00521	ZSTD_execSequenceEndSplitLitBuffer
8	543	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00543	ZSTD_decompressSequencesSplitLitBuffer_default
8	559	ZSTD_decompressSequences_bmi2	call site: 00559	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

136

Functions that are reachable but not covered

19

Reachable functions

58

Percentage of reachable functions covered

67.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_decompress.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_decompress_block.c	31
lib/decompress/../common/mem.h	14
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/compiler.h	3
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	1
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: decompress_cross_format

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1829	76.6%
gold	[1:9]	3	0.12%
yellow	[10:29]	5	0.20%
greenyellow	[30:49]	1	0.04%
lawngreen	50+	547	22.9%
All colors	2385	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
336	858	MEM_readLE16	call site: 00858	ZSTDv07_decompress_usingDict
243	213	ZSTD_decompressMultiFrame	call site: 00213	ZSTD_decompressLegacy
214	1195	ZSTD_XXH64_reset	call site: 01195	ZSTDv07_decompressBlock_internal
157	546	BIT_reloadDStream	call site: 00546	ZSTDv05_decompress_usingDict
148	708	MEM_readLE64	call site: 00708	ZSTDv05_decompress_continueDCtx
115	2117	ZSTD_decompressStream	call site: 02117	ZSTD_decompressLegacyStream
87	457	BIT_reloadDStream	call site: 00457	ZSTDv03_decompress
49	20	MEM_readLE32	call site: 00020	ZSTD_findFrameSizeInfoLegacy
41	71	MEM_readLE32	call site: 00071	ZSTDv07_findFrameSizeInfoLegacy
41	2235	ZSTD_decompressStream	call site: 02235	ZSTD_decompressLegacyStream
40	1956	ZSTD_execSequenceEndSplitLitBuffer	call site: 01956	ZSTD_decompressSequencesLong_default
29	1883	BIT_readBitsFast	call site: 01883	BIT_reloadDStream_internal

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

296

Reachable functions

397

Percentage of reachable functions covered

25.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_cross_format.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	51
lib/decompress/../legacy/zstd_legacy.h	8
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	67
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	30
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/common/error_private.c	1
lib/common/xxhash.h	16
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: decompress_dstSize_tooSmall

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2431	70.2%
gold	[1:9]	6	0.17%
yellow	[10:29]	2	0.05%
greenyellow	[30:49]	9	0.26%
lawngreen	50+	1013	29.2%
All colors	3461	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	2287	MEM_readLE16	call site: 02287	ZSTDv07_decompress_usingDict
282	1603	MEM_readLE32	call site: 01603	ZSTD_decompressLegacy
157	1975	BIT_reloadDStream	call site: 01975	ZSTDv05_decompress_usingDict
147	430	ZSTD_hash7	call site: 00430	ZSTD_updateTree
108	2177	MEM_writeLE16	call site: 02177	ZSTDv05_decompress_continueDCtx
87	1886	BIT_reloadDStream	call site: 01886	ZSTDv03_decompress
51	1373	ZSTD_blockSplitterEnabled	call site: 01373	ZSTD_compressBlock_splitBlock
50	1551	MEM_readLE32	call site: 01551	ZSTD_findFrameCompressedSizeLegacy
38	884	ZSTD_safecopyLiterals	call site: 00884	ZSTD_ldm_blockCompress
38	2137	MEM_readLE64	call site: 02137	FSEv05_initDState
38	3266	ZSTD_execSequenceEndSplitLitBuffer	call site: 03266	ZSTD_decompressSequencesLong_default
35	3392	ZSTD_freeCCtxContent	call site: 03392	ZSTDMT_freeCCtx

Runtime coverage analysis

Covered functions

398

Functions that are reachable but not covered

179

Reachable functions

456

Percentage of reachable functions covered

60.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_dstSize_tooSmall.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	117
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	31
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	41
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	3
lib/common/error_private.c	1
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1

Fuzzer: simple_compress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	709	44.8%
gold	[1:9]	2	0.12%
yellow	[10:29]	3	0.18%
greenyellow	[30:49]	9	0.56%
lawngreen	50+	859	54.2%
All colors	1582	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
75	428	ZSTD_hash8	call site: 00428	ZSTD_row_update
51	646	MEM_readLE64	call site: 00646	HUF_readStats_body_default
39	519	ZSTD_isAligned	call site: 00519	ZSTD_updateTree
38	878	ZSTD_safecopyLiterals	call site: 00878	ZSTD_ldm_blockCompress
35	1530	ZSTD_freeCCtxContent	call site: 01530	ZSTDMT_freeCCtx
34	340	ZSTD_window_update	call site: 00340	ZSTD_overflowCorrectIfNeeded
31	1195	ZSTD_buildBlockEntropyStats	call site: 01195	ZSTD_compressSubBlock_multi
26	592	ZSTD_insertBt1	call site: 00592	ZSTD_loadZstdDictionary
25	1245	HUF_compress1X_usingCTable_internal_bmi2	call site: 01245	MEM_writeLEST
22	293	ZSTD_resetCCtx_internal	call site: 00293	ZSTD_resetCCtx_byCopyingCDict
21	774	ZSTD_compress_frameChunk	call site: 00774	ZSTD_XXH64_update
21	1330	ZSTD_encodeSequences_bmi2	call site: 01330	ZSTD_compressSubBlock

Runtime coverage analysis

Covered functions

399

Functions that are reachable but not covered

138

Reachable functions

434

Percentage of reachable functions covered

68.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_compress.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	117
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/compress/zstd_compress_internal.h	41
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	2
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	2
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1

Fuzzer: block_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1088	52.4%
gold	[1:9]	10	0.48%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	975	47.0%
All colors	2074	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
75	440	ZSTD_hash8	call site: 00440	ZSTD_row_update
64	796	ZSTD_compressContinue_internal	call site: 00796	ZSTD_compress_frameChunk
64	1857	ZSTD_execSequenceEnd	call site: 01857	ZSTD_decompressSequencesLong_default
60	1382	ZSTD_minGain	call site: 01382	ZSTD_compressBlock_splitBlock
51	1580	BIT_reloadDStream_internal	call site: 01580	HUF_decompress4X_usingDTable
39	531	ZSTD_isAligned	call site: 00531	ZSTD_updateTree
38	902	ZSTD_safecopyLiterals	call site: 00902	ZSTD_ldm_blockCompress
35	1472	ZSTD_entropyCompressSeqStore_wExtLitBuffer	call site: 01472	ZSTD_compressBlock_internal
35	2002	ZSTD_freeCCtxContent	call site: 02002	ZSTDMT_freeCCtx
34	352	ZSTD_window_update	call site: 00352	ZSTD_overflowCorrectIfNeeded
34	1216	ZSTD_buildSequencesStatistics	call site: 01216	ZSTD_compressSubBlock_multi
29	1806	BIT_readBitsFast	call site: 01806	BIT_reloadDStream_internal

Runtime coverage analysis

Covered functions

443

Functions that are reachable but not covered

181

Reachable functions

458

Percentage of reachable functions covered

60.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	117
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	41
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	15
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/zstd_common.c	2
lib/common/error_private.c	1
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress_block.c	33
lib/decompress/../common/mem.h	14
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/compiler.h	3
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: sequence_compression_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2308	67.7%
gold	[1:9]	73	2.14%
yellow	[10:29]	4	0.11%
greenyellow	[30:49]	1	0.02%
lawngreen	50+	1023	30.0%
All colors	3409	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
581	2219	MEM_readLE16	call site: 02219	ZSTDv07_decompress_usingDict
282	1535	MEM_readLE32	call site: 01535	ZSTD_decompressLegacy
157	1907	BIT_reloadDStream	call site: 01907	ZSTDv05_decompress_usingDict
135	407	ZSTD_fillHashTableForCDict	call site: 00407	ZSTD_updateTree
108	2109	MEM_writeLE16	call site: 02109	ZSTDv05_decompress_continueDCtx
87	1818	BIT_reloadDStream	call site: 01818	ZSTDv03_decompress
83	992	ZSTD_freeCCtx	call site: 00992	ZSTDMT_initCStream_internal
74	888	ZSTD_CCtx_init_compressStream2	call site: 00888	ZSTDMT_createCCtx_advanced
48	1485	ZSTD_isLegacy	call site: 01485	ZSTD_findFrameCompressedSizeLegacy
38	2069	MEM_readLE64	call site: 02069	FSEv05_initDState
33	311	ZSTD_window_update	call site: 00311	ZSTD_ldm_fillHashTable
32	1242	MEM_writeLE24	call site: 01242	ZSTD_convertBlockSequences

Runtime coverage analysis

Covered functions

426

Functions that are reachable but not covered

161

Reachable functions

445

Percentage of reachable functions covered

63.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/sequence_compression_api.c	8
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	100
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	1
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	36
lib/decompress/../common/allocations.h	3
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	37
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	8
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	5
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	10
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/common/zstd_common.c	3
lib/common/error_private.c	1
lib/compress/zstdmt_compress.c	30
lib/common/pool.c	6
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_literals.c	5
lib/compress/hist.c	3
lib/compress/zstd_compress_sequences.c	11
lib/compress/../common/fse.h	5
lib/compress/../common/bitstream.h	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: generate_sequences

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2553	61.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1583	38.2%
All colors	4139	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	2995	MEM_readLE16	call site: 02995	ZSTDv07_decompress_usingDict
282	2311	MEM_readLE32	call site: 02311	ZSTD_decompressLegacy
157	2683	BIT_reloadDStream	call site: 02683	ZSTDv05_decompress_usingDict
108	2885	MEM_writeLE16	call site: 02885	ZSTDv05_decompress_continueDCtx
87	2594	BIT_reloadDStream	call site: 02594	ZSTDv03_decompress
84	3973	ZSTD_assertValidSequence	call site: 03973	ZSTD_decompressSequencesSplitLitBuffer
79	922	ZSTD_freeCCtx	call site: 00922	ZSTDMT_initCStream_internal
75	817	ZSTD_CCtx_init_compressStream2	call site: 00817	ZSTDMT_createCCtx_advanced
64	1152	ZSTD_compressStream2	call site: 01152	ZSTDMT_compressStream_generic
54	2070	ZSTD_compressEnd_public	call site: 02070	ZSTD_compressContinue_public
50	2259	MEM_readLE32	call site: 02259	ZSTD_findFrameCompressedSizeLegacy
39	596	ZSTD_isAligned	call site: 00596	ZSTD_updateTree

Runtime coverage analysis

Covered functions

575

Functions that are reachable but not covered

180

Reachable functions

565

Percentage of reachable functions covered

68.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/generate_sequences.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	151
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	31
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: zstd_frame_info

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	52	24.8%
gold	[1:9]	2	0.95%
yellow	[10:29]	6	2.87%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	149	71.2%
All colors	209	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	3	ZSTD_isLegacy	call site: 00003	MEM_isLittleEndian
4	11	ZSTDv05_getFrameParams	call site: 00011	MEM_isLittleEndian
4	17	ZSTDv06_getFrameParams	call site: 00017	MEM_isLittleEndian
4	26	ZSTDv06_getFrameParams	call site: 00026	MEM_isLittleEndian
4	34	MEM_readLE32	call site: 00034	MEM_readLE32
4	80	ZSTD_getFrameHeader_advanced	call site: 00080	MEM_isLittleEndian
3	104	ZSTDv02_findFrameSizeInfoLegacy	call site: 00104	MEM_isLittleEndian
3	115	ZSTDv03_findFrameSizeInfoLegacy	call site: 00115	MEM_isLittleEndian
3	126	ZSTDv04_findFrameSizeInfoLegacy	call site: 00126	MEM_isLittleEndian
2	23	ZSTDv06_getFrameParams	call site: 00023	MEM_isLittleEndian
2	50	MEM_readLE64	call site: 00050	MEM_read64
2	59	MEM_writeLE32	call site: 00059	MEM_swap32

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

3

Reachable functions

56

Percentage of reachable functions covered

94.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/zstd_frame_info.c	1
lib/decompress/zstd_decompress.c	16
lib/decompress/../legacy/zstd_legacy.h	3
lib/decompress/../common/mem.h	12
lib/legacy/zstd_v05.c	5
lib/legacy/../common/mem.h	4
lib/legacy/zstd_v06.c	14
lib/legacy/zstd_v07.c	15
lib/legacy/zstd_v01.c	5
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	7
lib/legacy/zstd_v03.c	7
lib/legacy/zstd_v04.c	7
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	1

Fuzzer: dictionary_stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1921	44.4%
gold	[1:9]	2	0.04%
yellow	[10:29]	10	0.23%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2384	55.2%
All colors	4317	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3229	MEM_readLE16	call site: 03229	ZSTDv07_decompress_usingDict
282	2545	MEM_readLE32	call site: 02545	ZSTD_decompressLegacy
157	2917	BIT_reloadDStream	call site: 02917	ZSTDv05_decompress_usingDict
108	3119	MEM_writeLE16	call site: 03119	ZSTDv05_decompress_continueDCtx
87	2828	BIT_reloadDStream	call site: 02828	ZSTDv03_decompress
60	4187	ZSTD_decompressSequencesLong_bmi2	call site: 04187	ZSTD_decompressSequencesSplitLitBuffer
48	2495	ZSTD_isLegacy	call site: 02495	ZSTD_findFrameCompressedSizeLegacy
38	3079	MEM_readLE64	call site: 03079	FSEv05_initDState
32	4124	ZSTD_decompressSequencesLong_bmi2	call site: 04124	ZSTD_execSequenceEnd
30	953	ZSTD_compress_frameChunk	call site: 00953	ZSTD_splitBlock
27	4096	BIT_readBitsFast	call site: 04096	BIT_reloadDStream_internal
25	1402	HUF_compress1X_usingCTable_internal_bmi2	call site: 01402	MEM_writeLEST

Runtime coverage analysis

Covered functions

800

Functions that are reachable but not covered

62

Reachable functions

622

Percentage of reachable functions covered

90.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_stream_round_trip.c	4
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	151
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: raw_dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2026	49.4%
gold	[1:9]	5	0.12%
yellow	[10:29]	7	0.17%
greenyellow	[30:49]	22	0.53%
lawngreen	50+	2037	49.7%
All colors	4097	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3008	MEM_readLE16	call site: 03008	ZSTDv07_decompress_usingDict
282	2324	MEM_readLE32	call site: 02324	ZSTD_decompressLegacy
157	2696	BIT_reloadDStream	call site: 02696	ZSTDv05_decompress_usingDict
108	2898	MEM_writeLE16	call site: 02898	ZSTDv05_decompress_continueDCtx
87	2607	BIT_reloadDStream	call site: 02607	ZSTDv03_decompress
60	3967	ZSTD_decompressSequencesLong_bmi2	call site: 03967	ZSTD_decompressSequencesSplitLitBuffer
48	2274	ZSTD_isLegacy	call site: 02274	ZSTD_findFrameCompressedSizeLegacy
38	2858	MEM_readLE64	call site: 02858	FSEv05_initDState
30	1378	ZSTD_compress_frameChunk	call site: 01378	ZSTD_splitBlock
27	3875	BIT_readBitsFast	call site: 03875	BIT_reloadDStream_internal
26	955	ZSTDMT_initCStream_internal	call site: 00955	ZSTDMT_resize
25	1796	HUF_compress1X_usingCTable_internal_bmi2	call site: 01796	MEM_writeLEST

Runtime coverage analysis

Covered functions

747

Functions that are reachable but not covered

83

Reachable functions

590

Percentage of reachable functions covered

85.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/raw_dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	144
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: dictionary_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1554	42.2%
gold	[1:9]	13	0.35%
yellow	[10:29]	16	0.43%
greenyellow	[30:49]	8	0.21%
lawngreen	50+	2089	56.7%
All colors	3680	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
134	412	ZSTD_fillHashTableForCDict	call site: 00412	ZSTD_updateTree
60	1508	ZSTD_minGain	call site: 01508	ZSTD_compressBlock_splitBlock
56	2174	FSE_buildDTable	call site: 02174	ZSTD_decodeSequence
54	2263	FSE_buildDTable	call site: 02263	ZSTD_decodeSequence
41	945	ZSTD_XXH64_update	call site: 00945	ZSTD_compressBlock_targetCBlockSize
38	1028	ZSTD_safecopyLiterals	call site: 01028	ZSTD_ldm_blockCompress
35	1598	ZSTD_entropyCompressSeqStore_wExtLitBuffer	call site: 01598	ZSTD_compressBlock_internal
35	1709	ZSTD_freeCCtxContent	call site: 01709	ZSTDMT_freeCCtx
34	1342	ZSTD_buildSequencesStatistics	call site: 01342	ZSTD_compressSubBlock_multi
32	3467	ZSTD_initFseState	call site: 03467	BIT_reloadDStream_internal
31	1281	ZSTD_buildSequencesStatistics	call site: 01281	ZSTD_NCountCost
28	1067	ZSTD_buildSeqStore	call site: 01067	ZSTD_transferSequences_wBlockDelim

Runtime coverage analysis

Covered functions

750

Functions that are reachable but not covered

177

Reachable functions

769

Percentage of reachable functions covered

76.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	1
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress.c	126
lib/compress/zstd_compress_internal.h	41
lib/compress/../common/mem.h	19
lib/compress/../common/error_private.h	1
lib/compress/../common/bits.h	7
lib/compress/zstd_cwksp.h	35
lib/compress/../common/compiler.h	1
lib/compress/../common/allocations.h	2
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/common/zstd_common.c	3
lib/decompress/zstd_ddict.c	9
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/common/error_private.c	1
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: seekable_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2922	67.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.02%
greenyellow	[30:49]	4	0.09%
lawngreen	50+	1407	32.4%
All colors	4334	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
534	2483	MEM_readLE16	call site: 02483	ZBUFFv07_decompressContinue
254	3289	MEM_readLE24	call site: 03289	ZSTD_decompress_usingDDict
146	802	ZSTD_CCtx_init_compressStream2	call site: 00802	ZSTDMT_initCStream_internal
121	2206	ZSTD_decompressStream	call site: 02206	ZSTD_decompressLegacyStream
107	2374	MEM_readLE64	call site: 02374	ZSTDv05_decompressSequences
105	3633	BIT_reloadDStream	call site: 03633	ZSTDv07_decompress_usingDict
92	3105	MEM_writeLE16	call site: 03105	ZSTD_decompressLegacyStream
87	3544	BIT_reloadDStream	call site: 03544	ZSTDv03_decompress
86	3201	ZSTD_decompressStream	call site: 03201	ZSTD_findFrameCompressedSize_advanced
75	473	ZSTD_hash8	call site: 00473	ZSTD_row_update
71	1149	MEM_writeLE16	call site: 01149	ZSTDMT_compressionJob
64	1082	ZSTD_compressStream2	call site: 01082	ZSTDMT_compressStream_generic

Runtime coverage analysis

Covered functions

593

Functions that are reachable but not covered

486

Reachable functions

908

Percentage of reachable functions covered

46.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/seekable_roundtrip.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	144
tests/fuzz/../../contrib/seekable_format/zstdseek_compress.c	12
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/compress/zstdmt_compress.c	53
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
tests/fuzz/../../contrib/seekable_format/zstdseek_decompress.c	8
lib/decompress/zstd_decompress.c	53
lib/decompress/../common/allocations.h	3
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/common/xxhash.h	16
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	16
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	5
lib/decompress/../common/error_private.h	1
lib/common/error_private.c	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	32
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2282	52.0%
gold	[1:9]	2	0.04%
yellow	[10:29]	9	0.20%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2088	47.6%
All colors	4381	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
534	2507	MEM_readLE16	call site: 02507	ZBUFFv07_decompressContinue
243	3329	ZSTD_decompressMultiFrame	call site: 03329	ZSTD_decompressLegacy
121	2230	ZSTD_decompressStream	call site: 02230	ZSTD_decompressLegacyStream
107	2398	MEM_readLE64	call site: 02398	ZSTDv05_decompressSequences
98	3662	BIT_reloadDStream	call site: 03662	ZSTDv07_decompress_usingDict
92	3134	MEM_writeLE16	call site: 03134	ZSTD_decompressLegacyStream
87	3573	BIT_reloadDStream	call site: 03573	ZSTDv03_decompress
84	4141	ZSTD_assertValidSequence	call site: 04141	ZSTD_decompressSequencesSplitLitBuffer
73	3233	ZSTD_findFrameSizeInfo	call site: 03233	ZSTD_findFrameSizeInfoLegacy
42	3090	ZSTD_getDDict	call site: 03090	ZSTD_initLegacyStream
40	2353	MEM_readLE32	call site: 02353	ZSTDv05_decompressContinue
34	4073	BIT_readBitsFast	call site: 04073	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

713

Functions that are reachable but not covered

353

Reachable functions

869

Percentage of reachable functions covered

59.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_round_trip.c	5
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	142
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	50
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/mem.h	16
lib/decompress/zstd_ddict.c	5
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	32
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: simple_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	822	39.4%
gold	[1:9]	6	0.28%
yellow	[10:29]	20	0.95%
greenyellow	[30:49]	7	0.33%
lawngreen	50+	1229	58.9%
All colors	2084	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	349	FSE_buildDTable	call site: 00349	ZSTD_decodeSequence
54	438	FSE_buildDTable	call site: 00438	ZSTD_decodeSequence
41	1909	ZSTD_execSequenceEndSplitLitBuffer	call site: 01909	ZSTD_decompressSequencesSplitLitBuffer
33	1832	ZSTD_initFseState	call site: 01832	BIT_reloadDStream_internal
31	1479	BIT_reloadDStream_internal	call site: 01479	FSE_decompress_wksp_body_default
26	1661	HUF_decompress1X_usingDTable	call site: 01661	HUF_decompress4X_usingDTable
25	1774	HUF_decompress4X1_DCtx_wksp	call site: 01774	ZSTD_buildSeqTable
25	1804	ZSTD_buildSeqTable	call site: 01804	ZSTD_decompressSequencesLong
24	1636	BIT_reloadDStream_internal	call site: 01636	HUF_decompress1X2_usingDTable_internal_default
23	317	ZSTDv02_decompress	call site: 00317	ZSTD_decompressDCtx
19	1076	HUFv07_fillDTableX4	call site: 01076	FSEv07_readNCount
18	1887	ZSTD_execSequenceEnd	call site: 01887	ZSTD_execSequenceEndSplitLitBuffer

Runtime coverage analysis

Covered functions

462

Functions that are reachable but not covered

8

Reachable functions

94

Percentage of reachable functions covered

91.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	36
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/common/xxhash.h	16
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	2
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3
lib/common/zstd_common.c	2

Fuzzer: huf_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	31.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	204	68.9%
All colors	296	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	188	BIT_reloadDStream_internal	call site: 00188	HUF_decompress1X2_usingDTable_internal_default
24	213	HUF_decompress1X_usingDTable	call site: 00213	HUF_decompress1X1_usingDTable_internal_bmi2
14	95	BIT_readBitsFast	call site: 00095	FSE_initDState
7	84	FSE_initDState	call site: 00084	BIT_reloadDStream_internal
6	181	BIT_initDStream	call site: 00181	BIT_reloadDStream_internal
3	75	BIT_initDStream	call site: 00075	FSE_initDState
2	42	MEM_readLE32	call site: 00042	MEM_read32
2	71	MEM_readLE64	call site: 00071	MEM_read64
2	164	HUF_decompress1X_usingDTable	call site: 00164	HUF_decompress1X2_usingDTable_internal_bmi2
2	171	MEM_readLE32	call site: 00171	MEM_read32
2	176	MEM_readLE64	call site: 00176	MEM_read64
1	7	FUZZ_dataProducer_int32Range	call site: 00007	FUZZ_dataProducer_uint32Range

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

7

Reachable functions

84

Percentage of reachable functions covered

91.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/common/cpu.h	2
lib/decompress/huf_decompress.c	26
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	1
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/mem.h	13
lib/common/zstd_common.c	1
lib/decompress/../common/bitstream.h	4
lib/decompress/../common/bits.h	3
lib/decompress/../common/compiler.h	1

Fuzzer: huf_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	128	21.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	7	1.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	463	77.4%
All colors	598	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	380	HUF_compress1X_usingCTable_internal_bmi2	call site: 00380	MEM_writeLEST
24	457	BIT_reloadDStream_internal	call site: 00457	HUF_decompress1X2_usingDTable_internal_default
24	482	HUF_decompress1X_usingDTable	call site: 00482	HUF_decompress1X1_usingDTable_internal_bmi2
14	295	BIT_readBitsFast	call site: 00295	FSE_initDState
7	284	FSE_initDState	call site: 00284	BIT_reloadDStream_internal
6	450	BIT_initDStream	call site: 00450	BIT_reloadDStream_internal
5	176	MEM_writeLEST	call site: 00176	MEM_writeLE32
2	40	LLVMFuzzerTestOneInput	call site: 00040	ERR_getErrorName
2	184	MEM_writeLE64	call site: 00184	MEM_swap64
2	247	MEM_readLE32	call site: 00247	MEM_read32
2	272	MEM_readLE64	call site: 00272	MEM_read64
2	276	BIT_initDStream	call site: 00276	FSE_initDState

Runtime coverage analysis

Covered functions

175

Functions that are reachable but not covered

13

Reachable functions

158

Percentage of reachable functions covered

91.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/common/cpu.h	2
lib/compress/hist.c	5
lib/compress/../common/mem.h	13
lib/common/zstd_common.c	2
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/common/bits.h	3
lib/compress/huf_compress.c	35
lib/compress/fse_compress.c	11
lib/compress/../common/bits.h	2
lib/compress/../common/error_private.h	1
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	4
lib/decompress/huf_decompress.c	26
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/mem.h	13
lib/decompress/../common/bitstream.h	4
lib/decompress/../common/bits.h	3
lib/decompress/../common/compiler.h	1

Fuzzer: fse_read_ncount

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	21.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.33%
lawngreen	50+	58	77.3%
All colors	75	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	27	LLVMFuzzerTestOneInput	call site: 00027	ERR_getErrorName
4	45	MEM_readLE32	call site: 00045	ZSTD_countTrailingZeros32
3	38	FSE_readNCount	call site: 00038	FSE_readNCount_body_bmi2
1	12	FUZZ_dataProducer_int32Range	call site: 00012	FUZZ_dataProducer_uint32Range
1	20	FSE_writeNCount	call site: 00020	FSE_writeNCount_generic
1	42	FSE_isError	call site: 00042	MEM_readLE32
1	50	ZSTD_countTrailingZeros32	call site: 00050	ZSTD_highbit32
1	73	LLVMFuzzerTestOneInput	call site: 00073	FUZZ_dataProducer_free

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

9

Reachable functions

24

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fse_read_ncount.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/fse_compress.c	3
lib/common/zstd_common.c	2
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/common/entropy_common.c	5
lib/common/mem.h	4
lib/common/bits.h	3

Fuzzer: simple_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2129	51.2%
gold	[1:9]	1	0.02%
yellow	[10:29]	7	0.16%
greenyellow	[30:49]	2	0.04%
lawngreen	50+	2017	48.5%
All colors	4156	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
560	2991	MEM_readLE16	call site: 02991	ZSTDv07_decompress_usingDict
282	2307	MEM_readLE32	call site: 02307	ZSTD_decompressLegacy
157	2679	BIT_reloadDStream	call site: 02679	ZSTDv05_decompress_usingDict
108	2881	MEM_writeLE16	call site: 02881	ZSTDv05_decompress_continueDCtx
87	2590	BIT_reloadDStream	call site: 02590	ZSTDv03_decompress
50	2255	MEM_readLE32	call site: 02255	ZSTD_findFrameCompressedSizeLegacy
45	3969	ZSTD_assertValidSequence	call site: 03969	ZSTD_decompressSequencesLong_default
38	2841	MEM_readLE64	call site: 02841	FSEv05_initDState
28	3901	BIT_readBitsFast	call site: 03901	BIT_reloadDStream_internal
26	936	ZSTDMT_initCStream_internal	call site: 00936	ZSTDMT_resize
25	1777	HUF_compress1X_usingCTable_internal_bmi2	call site: 01777	MEM_writeLEST
24	3707	BIT_reloadDStream_internal	call site: 03707	HUF_decompress1X2_usingDTable_internal_default

Runtime coverage analysis

Covered functions

693

Functions that are reachable but not covered

106

Reachable functions

599

Percentage of reachable functions covered

82.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_round_trip.c	3
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	149
tests/fuzz/fuzz_data_producer.c	8
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	37
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1953	45.1%
gold	[1:9]	3	0.06%
yellow	[10:29]	4	0.09%
greenyellow	[30:49]	5	0.11%
lawngreen	50+	2364	54.6%
All colors	4329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3241	MEM_readLE16	call site: 03241	ZSTDv07_decompress_usingDict
282	2557	MEM_readLE32	call site: 02557	ZSTD_decompressLegacy
157	2929	BIT_reloadDStream	call site: 02929	ZSTDv05_decompress_usingDict
108	3131	MEM_writeLE16	call site: 03131	ZSTDv05_decompress_continueDCtx
87	2840	BIT_reloadDStream	call site: 02840	ZSTDv03_decompress
48	2507	ZSTD_isLegacy	call site: 02507	ZSTD_findFrameCompressedSizeLegacy
38	3091	MEM_readLE64	call site: 03091	FSEv05_initDState
27	4108	BIT_readBitsFast	call site: 04108	BIT_reloadDStream_internal
26	2071	ZSTDMT_initCStream_internal	call site: 02071	ZSTDMT_resize
25	1403	HUF_compress1X_usingCTable_internal_bmi2	call site: 01403	MEM_writeLEST
24	3914	BIT_reloadDStream_internal	call site: 03914	HUF_decompress1X2_usingDTable_internal_default
23	3939	HUF_decompress1X_usingDTable	call site: 03939	HUF_decompress1X1_usingDTable_internal_bmi2

Runtime coverage analysis

Covered functions

817

Functions that are reachable but not covered

66

Reachable functions

627

Percentage of reachable functions covered

89.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	8
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	155
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: dictionary_loader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2700	67.5%
gold	[1:9]	10	0.25%
yellow	[10:29]	3	0.07%
greenyellow	[30:49]	8	0.20%
lawngreen	50+	1275	31.9%
All colors	3996	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	2908	MEM_readLE16	call site: 02908	ZSTDv07_decompress_usingDict
282	2224	MEM_readLE32	call site: 02224	ZSTD_decompressLegacy
157	2596	BIT_reloadDStream	call site: 02596	ZSTDv05_decompress_usingDict
118	678	ZSTD_CCtx_init_compressStream2	call site: 00678	ZSTDMT_createCCtx_advanced
118	1123	MEM_writeLE16	call site: 01123	ZSTDMT_compressionJob
108	2798	MEM_writeLE16	call site: 02798	ZSTDv05_decompress_continueDCtx
91	401	ZSTD_fillDoubleHashTableForCCtx	call site: 00401	ZSTD_updateTree
87	2507	BIT_reloadDStream	call site: 02507	ZSTDv03_decompress
85	826	ZSTD_freeCCtx	call site: 00826	ZSTDMT_initCStream_internal
64	1056	ZSTD_compressStream2	call site: 01056	ZSTDMT_compressStream_generic
54	1975	ZSTD_compressEnd_public	call site: 01975	ZSTD_compressContinue_public
51	1807	ZSTD_blockSplitterEnabled	call site: 01807	ZSTD_compressBlock_splitBlock

Runtime coverage analysis

Covered functions

463

Functions that are reachable but not covered

240

Reachable functions

577

Percentage of reachable functions covered

58.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_loader.c	3
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	138
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/compress/zstd_compress_internal.h	46
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: stream_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	829	35.4%
gold	[1:9]	9	0.38%
yellow	[10:29]	23	0.98%
greenyellow	[30:49]	7	0.29%
lawngreen	50+	1469	62.8%
All colors	2337	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	1433	FSE_buildDTable	call site: 01433	ZSTD_decodeSequence
54	1522	FSE_buildDTable	call site: 01522	ZSTD_decodeSequence
32	2058	ZSTD_initFseState	call site: 02058	BIT_reloadDStream_internal
31	1737	BIT_reloadDStream_internal	call site: 01737	FSE_decompress_wksp_body_default
31	2272	ZSTD_decompressContinueStream	call site: 02272	ZSTD_decompressBlock_internal
26	946	ZSTD_getFrameHeader_advanced	call site: 00946	ZSTD_DCtx_selectFrameDDict
26	1887	HUF_decompress1X_usingDTable	call site: 01887	HUF_decompress4X_usingDTable
25	1087	ZSTDv07_decompressBegin_usingDict	call site: 01087	ZSTDv07_decompress_insertDictionary
25	2000	HUF_decompress4X1_DCtx_wksp	call site: 02000	ZSTD_buildSeqTable
24	1862	BIT_reloadDStream_internal	call site: 01862	HUF_decompress1X2_usingDTable_internal_default
23	1401	ZSTDv02_decompress	call site: 01401	ZSTD_decompressDCtx
21	2155	ZSTD_decompressSequencesLong_bmi2	call site: 02155	ZSTD_decompressSequencesSplitLitBuffer

Runtime coverage analysis

Covered functions

529

Functions that are reachable but not covered

35

Reachable functions

406

Percentage of reachable functions covered

91.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_decompress.c	3
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	50
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/decompress/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/common/xxhash.h	16
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	30
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3