High level conclusions

Fuzzers reach 63.88% code coverage.

Fuzzers reach 31.71% of cyclomatic complexity.

Fuzzers reach 58.75% of all functions.

Fuzzer seekable_roundtrip is blocked:

The runtime code coverage of seekable_roundtrip covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer simple_round_trip is blocked:

The runtime code coverage of simple_round_trip covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer decompress_cross_format is blocked:

The runtime code coverage of decompress_cross_format covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dictionary_loader is blocked:

The runtime code coverage of dictionary_loader covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer decompress_dstSize_tooSmall is blocked:

The runtime code coverage of decompress_dstSize_tooSmall covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer simple_compress is blocked:

The runtime code coverage of simple_compress covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1020 / 1736

Cyclomatic complexity statically reachable by fuzzers

7298 / 23012

Runtime code coverage of functions

1109 / 1736

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fse_read_ncount

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	21.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.33%
lawngreen	50+	58	77.3%
All colors	75	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	27	LLVMFuzzerTestOneInput	call site: 00027	ERR_getErrorName
4	45	MEM_readLE32	call site: 00045	ZSTD_countTrailingZeros32
3	38	FSE_readNCount	call site: 00038	FSE_readNCount_body_bmi2
1	12	FUZZ_dataProducer_int32Range	call site: 00012	FUZZ_dataProducer_uint32Range
1	20	FSE_writeNCount	call site: 00020	FSE_writeNCount_generic
1	42	FSE_isError	call site: 00042	MEM_readLE32
1	50	ZSTD_countTrailingZeros32	call site: 00050	ZSTD_highbit32
1	73	LLVMFuzzerTestOneInput	call site: 00073	FUZZ_dataProducer_free

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

9

Reachable functions

24

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fse_read_ncount.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/fse_compress.c	3
lib/common/zstd_common.c	2
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/common/entropy_common.c	5
lib/common/mem.h	4
lib/common/bits.h	3

Fuzzer: simple_compress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1590	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1590	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1589	0	EP	call site: 00000	ZSTD_compressCCtx

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

435

Reachable functions

435

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_compress.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	117
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	2
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	2
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1

Fuzzer: decompress_dstSize_tooSmall

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3465	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	3465	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3464	0	EP	call site: 00000	ZSTD_compressCCtx

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

457

Reachable functions

457

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_dstSize_tooSmall.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	117
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	31
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	3
lib/common/error_private.c	1
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1

Fuzzer: dictionary_loader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4000	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	4000	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3999	0	EP	call site: 00000	compress

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

578

Reachable functions

578

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_loader.c	3
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	138
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: block_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	293	49.0%
gold	[1:9]	3	0.50%
yellow	[10:29]	1	0.16%
greenyellow	[30:49]	1	0.16%
lawngreen	50+	299	50.0%
All colors	597	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	83	BIT_lookBitsFast	call site: 00083	HUF_decompress4X_usingDTable
40	472	ZSTD_execSequenceEndSplitLitBuffer	call site: 00472	ZSTD_decompressSequencesLong_default
29	400	BIT_readBitsFast	call site: 00400	BIT_reloadDStream_internal
19	253	BIT_readBitsFast	call site: 00253	FSE_decompress_wksp_body_default
18	450	ZSTD_execSequenceEnd	call site: 00450	ZSTD_execSequenceEndSplitLitBuffer
13	380	ZSTD_decompressBlock_internal	call site: 00380	ZSTD_decompressSequencesLong
13	582	ZSTD_freeDCtx	call site: 00582	ZSTD_freeLegacyStreamContext
12	529	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00529	ZSTD_execSequenceEnd
8	7	FUZZ_malloc_rand	call site: 00007	FUZZ_dataProducer_int32Range
8	520	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00520	ZSTD_execSequenceEndSplitLitBuffer
8	542	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00542	ZSTD_decompressSequencesSplitLitBuffer_default
8	558	ZSTD_decompressSequences_bmi2	call site: 00558	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

136

Functions that are reachable but not covered

19

Reachable functions

58

Percentage of reachable functions covered

67.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_decompress.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_decompress_block.c	31
lib/decompress/../common/mem.h	14
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/compiler.h	3
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	1
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: decompress_cross_format

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2381	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2381	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2380	0	EP	call site: 00000	ZSTD_decompressStream

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

397

Reachable functions

397

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_cross_format.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	51
lib/decompress/../legacy/zstd_legacy.h	8
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	67
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	30
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/common/error_private.c	1
lib/common/xxhash.h	16
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: simple_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	815	39.1%
gold	[1:9]	7	0.33%
yellow	[10:29]	12	0.57%
greenyellow	[30:49]	6	0.28%
lawngreen	50+	1242	59.6%
All colors	2082	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	349	FSE_buildDTable	call site: 00349	ZSTD_decodeSequence
54	439	FSE_buildDTable	call site: 00439	ZSTD_decodeSequence
41	1908	ZSTD_execSequenceEndSplitLitBuffer	call site: 01908	ZSTD_decompressSequencesSplitLitBuffer
33	1832	ZSTD_initFseState	call site: 01832	BIT_reloadDStream_internal
31	1479	BIT_reloadDStream_internal	call site: 01479	FSE_decompress_wksp_body_default
26	1661	HUF_decompress1X_usingDTable	call site: 01661	HUF_decompress4X_usingDTable
25	1774	HUF_decompress4X1_DCtx_wksp	call site: 01774	ZSTD_buildSeqTable
25	1804	ZSTD_buildSeqTable	call site: 01804	ZSTD_decompressSequencesLong
24	1636	BIT_reloadDStream_internal	call site: 01636	HUF_decompress1X2_usingDTable_internal_default
19	1077	HUFv07_fillDTableX4	call site: 01077	FSEv07_readNCount
18	1886	ZSTD_execSequenceEnd	call site: 01886	ZSTD_execSequenceEndSplitLitBuffer
18	2063	LLVMFuzzerTestOneInput	call site: 02063	ZSTD_freeLegacyStreamContext

Runtime coverage analysis

Covered functions

455

Functions that are reachable but not covered

8

Reachable functions

94

Percentage of reachable functions covered

91.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	36
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/common/xxhash.h	16
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	2
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3
lib/common/zstd_common.c	2

Fuzzer: zstd_frame_info

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	52	24.8%
gold	[1:9]	2	0.95%
yellow	[10:29]	8	3.82%
greenyellow	[30:49]	2	0.95%
lawngreen	50+	145	69.3%
All colors	209	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	3	ZSTD_isLegacy	call site: 00003	MEM_isLittleEndian
4	11	ZSTDv05_getFrameParams	call site: 00011	MEM_isLittleEndian
4	17	ZSTDv06_getFrameParams	call site: 00017	MEM_isLittleEndian
4	26	ZSTDv06_getFrameParams	call site: 00026	MEM_isLittleEndian
4	34	MEM_readLE32	call site: 00034	MEM_readLE32
4	80	ZSTD_getFrameHeader_advanced	call site: 00080	MEM_isLittleEndian
3	104	ZSTDv02_findFrameSizeInfoLegacy	call site: 00104	MEM_isLittleEndian
3	115	ZSTDv03_findFrameSizeInfoLegacy	call site: 00115	MEM_isLittleEndian
3	126	ZSTDv04_findFrameSizeInfoLegacy	call site: 00126	MEM_isLittleEndian
2	23	ZSTDv06_getFrameParams	call site: 00023	MEM_isLittleEndian
2	50	MEM_readLE64	call site: 00050	MEM_read64
2	59	MEM_writeLE32	call site: 00059	MEM_swap32

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

3

Reachable functions

56

Percentage of reachable functions covered

94.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/zstd_frame_info.c	1
lib/decompress/zstd_decompress.c	16
lib/decompress/../legacy/zstd_legacy.h	3
lib/decompress/../common/mem.h	12
lib/legacy/zstd_v05.c	5
lib/legacy/../common/mem.h	4
lib/legacy/zstd_v06.c	14
lib/legacy/zstd_v07.c	15
lib/legacy/zstd_v01.c	5
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	7
lib/legacy/zstd_v03.c	7
lib/legacy/zstd_v04.c	7
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	1

Fuzzer: stream_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	820	35.1%
gold	[1:9]	13	0.55%
yellow	[10:29]	19	0.81%
greenyellow	[30:49]	7	0.30%
lawngreen	50+	1474	63.1%
All colors	2333	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	1433	FSE_buildDTable	call site: 01433	ZSTD_decodeSequence
54	1523	FSE_buildDTable	call site: 01523	ZSTD_decodeSequence
32	2057	ZSTD_initFseState	call site: 02057	BIT_reloadDStream_internal
31	1737	BIT_reloadDStream_internal	call site: 01737	FSE_decompress_wksp_body_default
29	2270	ZSTD_decompressContinueStream	call site: 02270	ZSTD_decompressBlock_internal
26	946	ZSTD_getFrameHeader_advanced	call site: 00946	ZSTD_DCtx_selectFrameDDict
26	1887	HUF_decompress1X_usingDTable	call site: 01887	HUF_decompress4X_usingDTable
25	1087	ZSTDv07_decompressBegin_usingDict	call site: 01087	ZSTDv07_decompress_insertDictionary
25	2000	HUF_decompress4X1_DCtx_wksp	call site: 02000	ZSTD_buildSeqTable
24	1862	BIT_reloadDStream_internal	call site: 01862	HUF_decompress1X2_usingDTable_internal_default
21	2153	ZSTD_decompressSequencesLong_bmi2	call site: 02153	ZSTD_decompressSequencesSplitLitBuffer
19	2133	ZSTD_execSequenceEndSplitLitBuffer	call site: 02133	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

522

Functions that are reachable but not covered

35

Reachable functions

406

Percentage of reachable functions covered

91.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_decompress.c	3
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	50
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/decompress/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/common/xxhash.h	16
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	30
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: dictionary_stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1921	44.4%
gold	[1:9]	2	0.04%
yellow	[10:29]	7	0.16%
greenyellow	[30:49]	10	0.23%
lawngreen	50+	2381	55.1%
All colors	4321	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3234	MEM_readLE16	call site: 03234	ZSTDv07_decompress_usingDict
281	2550	MEM_readLE32	call site: 02550	ZSTD_decompressLegacy
157	2922	BIT_reloadDStream	call site: 02922	ZSTDv05_decompress_usingDict
108	3124	MEM_writeLE16	call site: 03124	ZSTDv05_decompress_continueDCtx
88	2832	BIT_reloadDStream	call site: 02832	ZSTDv03_decompress
60	4190	ZSTD_decompressSequencesLong_bmi2	call site: 04190	ZSTD_decompressSequencesSplitLitBuffer
48	2500	ZSTD_isLegacy	call site: 02500	ZSTD_findFrameCompressedSizeLegacy
38	3084	MEM_readLE64	call site: 03084	FSEv05_initDState
30	4124	ZSTD_decompressSequencesLong_bmi2	call site: 04124	ZSTD_execSequenceEnd
29	954	ZSTD_compress_frameChunk	call site: 00954	ZSTD_splitBlock
27	4096	BIT_readBitsFast	call site: 04096	BIT_reloadDStream_internal
26	4163	ZSTD_assertValidSequence	call site: 04163	ZSTD_execSequenceEndSplitLitBuffer

Runtime coverage analysis

Covered functions

801

Functions that are reachable but not covered

62

Reachable functions

623

Percentage of reachable functions covered

90.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_stream_round_trip.c	4
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	151
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2286	52.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	6	0.13%
greenyellow	[30:49]	11	0.25%
lawngreen	50+	2082	47.4%
All colors	4385	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
534	2512	MEM_readLE16	call site: 02512	ZBUFFv07_decompressContinue
242	3337	ZSTD_decompressMultiFrame	call site: 03337	ZSTD_decompressLegacy
121	2235	ZSTD_decompressStream	call site: 02235	ZSTD_decompressLegacyStream
107	2403	MEM_readLE64	call site: 02403	ZSTDv05_decompressSequences
98	3670	BIT_reloadDStream	call site: 03670	ZSTDv07_decompress_usingDict
92	3141	MEM_writeLE16	call site: 03141	ZSTD_decompressLegacyStream
88	3580	BIT_reloadDStream	call site: 03580	ZSTDv03_decompress
87	4141	ZSTD_assertValidSequence	call site: 04141	ZSTD_decompressSequencesSplitLitBuffer
73	3240	ZSTD_findFrameSizeInfo	call site: 03240	ZSTD_findFrameSizeInfoLegacy
42	3097	ZSTD_getDDict	call site: 03097	ZSTD_initLegacyStream
40	2358	MEM_readLE32	call site: 02358	ZSTDv05_decompressContinue
33	4074	BIT_readBitsFast	call site: 04074	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

714

Functions that are reachable but not covered

353

Reachable functions

870

Percentage of reachable functions covered

59.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_round_trip.c	5
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	142
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	50
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/mem.h	16
lib/decompress/zstd_ddict.c	5
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	32
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1962	45.2%
gold	[1:9]	5	0.11%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.02%
lawngreen	50+	2365	54.5%
All colors	4333	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3246	MEM_readLE16	call site: 03246	ZSTDv07_decompress_usingDict
281	2562	MEM_readLE32	call site: 02562	ZSTD_decompressLegacy
157	2934	BIT_reloadDStream	call site: 02934	ZSTDv05_decompress_usingDict
108	3136	MEM_writeLE16	call site: 03136	ZSTDv05_decompress_continueDCtx
88	2844	BIT_reloadDStream	call site: 02844	ZSTDv03_decompress
48	2512	ZSTD_isLegacy	call site: 02512	ZSTD_findFrameCompressedSizeLegacy
38	3096	MEM_readLE64	call site: 03096	FSEv05_initDState
27	4108	BIT_readBitsFast	call site: 04108	BIT_reloadDStream_internal
26	2077	ZSTDMT_initCStream_internal	call site: 02077	ZSTDMT_resize
26	4175	ZSTD_assertValidSequence	call site: 04175	ZSTD_execSequenceEndSplitLitBuffer
25	1403	HUF_compress1X_usingCTable_internal_bmi2	call site: 01403	MEM_writeLEST
24	3916	BIT_reloadDStream_internal	call site: 03916	HUF_decompress1X2_usingDTable_internal_default

Runtime coverage analysis

Covered functions

818

Functions that are reachable but not covered

66

Reachable functions

628

Percentage of reachable functions covered

89.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	8
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	155
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: raw_dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2028	49.4%
gold	[1:9]	1	0.02%
yellow	[10:29]	4	0.09%
greenyellow	[30:49]	2	0.04%
lawngreen	50+	2066	50.3%
All colors	4101	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3014	MEM_readLE16	call site: 03014	ZSTDv07_decompress_usingDict
281	2330	MEM_readLE32	call site: 02330	ZSTD_decompressLegacy
157	2702	BIT_reloadDStream	call site: 02702	ZSTDv05_decompress_usingDict
108	2904	MEM_writeLE16	call site: 02904	ZSTDv05_decompress_continueDCtx
88	2612	BIT_reloadDStream	call site: 02612	ZSTDv03_decompress
60	3970	ZSTD_decompressSequencesLong_bmi2	call site: 03970	ZSTD_decompressSequencesSplitLitBuffer
48	2280	ZSTD_isLegacy	call site: 02280	ZSTD_findFrameCompressedSizeLegacy
38	2864	MEM_readLE64	call site: 02864	FSEv05_initDState
29	1375	ZSTD_compress_frameChunk	call site: 01375	ZSTD_splitBlock
27	3876	BIT_readBitsFast	call site: 03876	BIT_reloadDStream_internal
26	955	ZSTDMT_initCStream_internal	call site: 00955	ZSTDMT_resize
26	3943	ZSTD_assertValidSequence	call site: 03943	ZSTD_execSequenceEndSplitLitBuffer

Runtime coverage analysis

Covered functions

748

Functions that are reachable but not covered

83

Reachable functions

591

Percentage of reachable functions covered

85.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/raw_dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	144
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: simple_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4161	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	4161	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4160	0	EP	call site: 00000	roundTripTest

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

600

Reachable functions

600

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_round_trip.c	3
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	149
tests/fuzz/fuzz_data_producer.c	8
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	37
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: seekable_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4337	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	4337	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4336	0	EP	call site: 00000	ZSTD_seekable_compressStream

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

909

Reachable functions

909

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/seekable_roundtrip.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	144
tests/fuzz/../../contrib/seekable_format/zstdseek_compress.c	12
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/compress/zstdmt_compress.c	53
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
tests/fuzz/../../contrib/seekable_format/zstdseek_decompress.c	8
lib/decompress/zstd_decompress.c	53
lib/decompress/../common/allocations.h	3
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/common/xxhash.h	16
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	16
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	5
lib/decompress/../common/error_private.h	1
lib/common/error_private.c	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	32
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: huf_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	21.0%
gold	[1:9]	5	0.83%
yellow	[10:29]	2	0.33%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	465	77.7%
All colors	598	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	380	HUF_compress1X_usingCTable_internal_bmi2	call site: 00380	MEM_writeLEST
24	456	BIT_reloadDStream_internal	call site: 00456	HUF_decompress1X2_usingDTable_internal_default
24	481	HUF_decompress1X_usingDTable	call site: 00481	HUF_decompress1X1_usingDTable_internal_bmi2
14	295	BIT_readBitsFast	call site: 00295	FSE_initDState
6	285	FSE_initDState	call site: 00285	BIT_reloadDStream_internal
6	449	BIT_initDStream	call site: 00449	BIT_reloadDStream_internal
5	176	MEM_writeLEST	call site: 00176	MEM_writeLE32
2	40	LLVMFuzzerTestOneInput	call site: 00040	ERR_getErrorName
2	184	MEM_writeLE64	call site: 00184	MEM_swap64
2	247	MEM_readLE32	call site: 00247	MEM_read32
2	273	MEM_readLE64	call site: 00273	MEM_read64
2	277	BIT_initDStream	call site: 00277	FSE_initDState

Runtime coverage analysis

Covered functions

175

Functions that are reachable but not covered

13

Reachable functions

158

Percentage of reachable functions covered

91.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/common/cpu.h	2
lib/compress/hist.c	5
lib/compress/../common/mem.h	13
lib/common/zstd_common.c	2
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/common/bits.h	3
lib/compress/huf_compress.c	35
lib/compress/fse_compress.c	11
lib/compress/../common/bits.h	2
lib/compress/../common/error_private.h	1
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	4
lib/decompress/huf_decompress.c	26
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/mem.h	13
lib/decompress/../common/bitstream.h	4
lib/decompress/../common/bits.h	3
lib/decompress/../common/compiler.h	1

Fuzzer: dictionary_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1552	42.1%
gold	[1:9]	9	0.24%
yellow	[10:29]	15	0.40%
greenyellow	[30:49]	2	0.05%
lawngreen	50+	2106	57.1%
All colors	3684	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
135	412	ZSTD_fillHashTableForCDict	call site: 00412	ZSTD_updateTree
61	1511	ZSTD_minGain	call site: 01511	ZSTD_compressBlock_splitBlock
54	2180	FSE_buildDTable	call site: 02180	ZSTD_decodeSequence
54	2270	FSE_buildDTable	call site: 02270	ZSTD_decodeSequence
40	946	ZSTD_XXH64_update	call site: 00946	ZSTD_compressBlock_targetCBlockSize
38	1028	ZSTD_safecopyLiterals	call site: 01028	ZSTD_ldm_blockCompress
36	1340	ZSTD_buildSequencesStatistics	call site: 01340	ZSTD_compressSubBlock_multi
35	1605	ZSTD_entropyCompressSeqStore_wExtLitBuffer	call site: 01605	ZSTD_compressBlock_internal
35	1716	ZSTD_freeCCtxContent	call site: 01716	ZSTDMT_freeCCtx
31	1278	ZSTD_buildSequencesStatistics	call site: 01278	ZSTD_NCountCost
31	3469	ZSTD_initFseState	call site: 03469	BIT_reloadDStream_internal
27	1482	ZSTD_encodeSequences_bmi2	call site: 01482	ZSTD_compressSubBlock

Runtime coverage analysis

Covered functions

744

Functions that are reachable but not covered

177

Reachable functions

770

Percentage of reachable functions covered

77.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	1
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress.c	126
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/error_private.h	1
lib/compress/../common/bits.h	7
lib/compress/zstd_cwksp.h	35
lib/compress/../common/compiler.h	1
lib/compress/../common/allocations.h	2
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/common/zstd_common.c	3
lib/decompress/zstd_ddict.c	9
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/common/error_private.c	1
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: huf_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	31.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	204	68.9%
All colors	296	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	188	BIT_reloadDStream_internal	call site: 00188	HUF_decompress1X2_usingDTable_internal_default
24	213	HUF_decompress1X_usingDTable	call site: 00213	HUF_decompress1X1_usingDTable_internal_bmi2
14	95	BIT_readBitsFast	call site: 00095	FSE_initDState
7	84	FSE_initDState	call site: 00084	BIT_reloadDStream_internal
6	181	BIT_initDStream	call site: 00181	BIT_reloadDStream_internal
3	75	BIT_initDStream	call site: 00075	FSE_initDState
2	42	MEM_readLE32	call site: 00042	MEM_read32
2	71	MEM_readLE64	call site: 00071	MEM_read64
2	164	HUF_decompress1X_usingDTable	call site: 00164	HUF_decompress1X2_usingDTable_internal_bmi2
2	171	MEM_readLE32	call site: 00171	MEM_read32
2	176	MEM_readLE64	call site: 00176	MEM_read64
1	7	FUZZ_dataProducer_int32Range	call site: 00007	FUZZ_dataProducer_uint32Range

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

7

Reachable functions

84

Percentage of reachable functions covered

91.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/common/cpu.h	2
lib/decompress/huf_decompress.c	26
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	1
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/mem.h	13
lib/common/zstd_common.c	1
lib/decompress/../common/bitstream.h	4
lib/decompress/../common/bits.h	3
lib/decompress/../common/compiler.h	1

Fuzzer: generate_sequences

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2557	61.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1586	38.2%
All colors	4145	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3003	MEM_readLE16	call site: 03003	ZSTDv07_decompress_usingDict
281	2319	MEM_readLE32	call site: 02319	ZSTD_decompressLegacy
157	2691	BIT_reloadDStream	call site: 02691	ZSTDv05_decompress_usingDict
108	2893	MEM_writeLE16	call site: 02893	ZSTDv05_decompress_continueDCtx
88	2601	BIT_reloadDStream	call site: 02601	ZSTDv03_decompress
87	3975	ZSTD_assertValidSequence	call site: 03975	ZSTD_decompressSequencesSplitLitBuffer
78	923	ZSTD_freeCCtx	call site: 00923	ZSTDMT_initCStream_internal
75	818	ZSTD_CCtx_init_compressStream2	call site: 00818	ZSTDMT_createCCtx_advanced
62	1152	ZSTD_compressStream2	call site: 01152	ZSTDMT_compressStream_generic
54	2075	ZSTD_compressEnd_public	call site: 02075	ZSTD_compressContinue_public
50	2267	MEM_readLE32	call site: 02267	ZSTD_findFrameCompressedSizeLegacy
40	596	ZSTD_isAligned	call site: 00596	ZSTD_updateTree

Runtime coverage analysis

Covered functions

576

Functions that are reachable but not covered

180

Reachable functions

566

Percentage of reachable functions covered

68.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/generate_sequences.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	151
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstdmt_compress.c	52
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	31
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: sequence_compression_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2311	67.7%
gold	[1:9]	73	2.14%
yellow	[10:29]	4	0.11%
greenyellow	[30:49]	1	0.02%
lawngreen	50+	1021	29.9%
All colors	3410	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
581	2223	MEM_readLE16	call site: 02223	ZSTDv07_decompress_usingDict
281	1539	MEM_readLE32	call site: 01539	ZSTD_decompressLegacy
157	1911	BIT_reloadDStream	call site: 01911	ZSTDv05_decompress_usingDict
136	407	ZSTD_fillHashTableForCDict	call site: 00407	ZSTD_updateTree
108	2113	MEM_writeLE16	call site: 02113	ZSTDv05_decompress_continueDCtx
88	1821	BIT_reloadDStream	call site: 01821	ZSTDv03_decompress
82	995	ZSTD_freeCCtx	call site: 00995	ZSTDMT_initCStream_internal
74	891	ZSTD_CCtx_init_compressStream2	call site: 00891	ZSTDMT_createCCtx_advanced
48	1489	ZSTD_isLegacy	call site: 01489	ZSTD_findFrameCompressedSizeLegacy
38	2073	MEM_readLE64	call site: 02073	FSEv05_initDState
33	311	ZSTD_window_update	call site: 00311	ZSTD_ldm_fillHashTable
32	1244	MEM_writeLE24	call site: 01244	ZSTD_convertBlockSequences

Runtime coverage analysis

Covered functions

427

Functions that are reachable but not covered

161

Reachable functions

446

Percentage of reachable functions covered

63.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/sequence_compression_api.c	8
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	100
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	1
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	36
lib/decompress/../common/allocations.h	3
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	38
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	8
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	5
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	10
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/common/zstd_common.c	3
lib/common/error_private.c	1
lib/compress/zstdmt_compress.c	30
lib/common/pool.c	6
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_literals.c	5
lib/compress/hist.c	3
lib/compress/zstd_compress_sequences.c	11
lib/compress/../common/fse.h	5
lib/compress/../common/bitstream.h	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: block_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1095	52.7%
gold	[1:9]	10	0.48%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	971	46.7%
All colors	2077	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
75	440	ZSTD_hash8	call site: 00440	ZSTD_row_update
67	1856	ZSTD_execSequenceEnd	call site: 01856	ZSTD_decompressSequencesLong_default
63	797	ZSTD_compressContinue_internal	call site: 00797	ZSTD_compress_frameChunk
61	1385	ZSTD_minGain	call site: 01385	ZSTD_compressBlock_splitBlock
50	1586	BIT_reloadDStream_internal	call site: 01586	HUF_decompress4X_usingDTable
40	531	ZSTD_isAligned	call site: 00531	ZSTD_updateTree
38	902	ZSTD_safecopyLiterals	call site: 00902	ZSTD_ldm_blockCompress
36	1214	ZSTD_buildSequencesStatistics	call site: 01214	ZSTD_compressSubBlock_multi
35	1479	ZSTD_entropyCompressSeqStore_wExtLitBuffer	call site: 01479	ZSTD_compressBlock_internal
35	2005	ZSTD_freeCCtxContent	call site: 02005	ZSTDMT_freeCCtx
34	352	ZSTD_window_update	call site: 00352	ZSTD_overflowCorrectIfNeeded
28	1809	BIT_readBitsFast	call site: 01809	BIT_reloadDStream_internal

Runtime coverage analysis

Covered functions

444

Functions that are reachable but not covered

181

Reachable functions

459

Percentage of reachable functions covered

60.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	117
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	15
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/zstd_common.c	2
lib/common/error_private.c	1
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress_block.c	33
lib/decompress/../common/mem.h	14
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/compiler.h	3
lib/compress/zstdmt_compress.c	8
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
ZSTD_compressBlock_btlazy2_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	4574
ZSTD_decompressSequencesLong	/src/zstd/lib/decompress/zstd_decompress_block.c	7	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'int', 'int']	6	0	60	8	3	36	0	760	708
ZDICT_trainFromBuffer_legacy	/src/zstd/lib/dictBuilder/zdict.c	6	['N/A', 'size_t', 'N/A', 'N/A', 'int', 'N/A']	25	0	74	8	4	488	0	3867	696
ZSTD_compressBlock_lazy2_extDict_row	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_lazy2_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_lazy_extDict_row	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_lazy_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_greedy_extDict_row	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_greedy_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_decompressSequencesSplitLitBuffer	/src/zstd/lib/decompress/zstd_decompress_block.c	7	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'int', 'int']	6	0	60	8	3	34	0	560	431

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1162 / 1736

Cyclomatic complexity statically reachable by fuzzers

17697 / 23012

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzz/fse_read_ncount.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'MEM_readLE32', 'FSE_readNCount', 'FUZZ_dataProducer_int32Range', 'FSE_writeNCount', 'FSE_isError', 'ZSTD_countTrailingZeros32']

tests/fuzz/simple_compress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/decompress_dstSize_tooSmall.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/dictionary_loader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/block_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['BIT_lookBitsFast', 'ZSTD_execSequenceEndSplitLitBuffer', 'BIT_readBitsFast', 'ZSTD_execSequenceEnd', 'ZSTD_decompressBlock_internal', 'ZSTD_freeDCtx', 'ZSTD_decompressSequencesSplitLitBuffer_bmi2', 'FUZZ_malloc_rand']

tests/fuzz/decompress_cross_format.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/simple_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['FSE_buildDTable', 'ZSTD_execSequenceEndSplitLitBuffer', 'ZSTD_initFseState', 'BIT_reloadDStream_internal', 'HUF_decompress1X_usingDTable', 'HUF_decompress4X1_DCtx_wksp', 'ZSTD_buildSeqTable', 'HUFv07_fillDTableX4']

tests/fuzz/zstd_frame_info.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ZSTD_isLegacy', 'ZSTDv05_getFrameParams', 'ZSTDv06_getFrameParams', 'MEM_readLE32', 'ZSTD_getFrameHeader_advanced', 'ZSTDv02_findFrameSizeInfoLegacy', 'ZSTDv03_findFrameSizeInfoLegacy', 'ZSTDv04_findFrameSizeInfoLegacy']

tests/fuzz/stream_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['FSE_buildDTable', 'ZSTD_initFseState', 'BIT_reloadDStream_internal', 'ZSTD_decompressContinueStream', 'ZSTD_getFrameHeader_advanced', 'HUF_decompress1X_usingDTable', 'ZSTDv07_decompressBegin_usingDict', 'HUF_decompress4X1_DCtx_wksp']

tests/fuzz/dictionary_stream_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_decompressSequencesLong_bmi2', 'ZSTD_isLegacy', 'MEM_readLE64', 'ZSTD_compress_frameChunk']

tests/fuzz/stream_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'ZSTD_decompressMultiFrame', 'ZSTD_decompressStream', 'MEM_readLE64', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_assertValidSequence', 'ZSTD_findFrameSizeInfo', 'ZSTD_getDDict']

tests/fuzz/dictionary_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_isLegacy', 'MEM_readLE64', 'BIT_readBitsFast', 'ZSTDMT_initCStream_internal', 'ZSTD_assertValidSequence']

tests/fuzz/raw_dictionary_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_decompressSequencesLong_bmi2', 'ZSTD_isLegacy', 'MEM_readLE64', 'ZSTD_compress_frameChunk', 'BIT_readBitsFast']

tests/fuzz/simple_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/seekable_roundtrip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/huf_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['HUF_compress1X_usingCTable_internal_bmi2', 'BIT_reloadDStream_internal', 'HUF_decompress1X_usingDTable', 'BIT_readBitsFast', 'FSE_initDState', 'BIT_initDStream', 'MEM_writeLEST', 'LLVMFuzzerTestOneInput', 'MEM_writeLE64', 'MEM_readLE32']

tests/fuzz/dictionary_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ZSTD_fillHashTableForCDict', 'ZSTD_minGain', 'FSE_buildDTable', 'ZSTD_XXH64_update', 'ZSTD_safecopyLiterals', 'ZSTD_buildSequencesStatistics', 'ZSTD_entropyCompressSeqStore_wExtLitBuffer', 'ZSTD_freeCCtxContent']

tests/fuzz/huf_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['BIT_reloadDStream_internal', 'HUF_decompress1X_usingDTable', 'BIT_readBitsFast', 'FSE_initDState', 'BIT_initDStream', 'MEM_readLE32', 'MEM_readLE64']

tests/fuzz/generate_sequences.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_assertValidSequence', 'ZSTD_freeCCtx', 'ZSTD_CCtx_init_compressStream2', 'ZSTD_compressStream2', 'ZSTD_compressEnd_public']

tests/fuzz/sequence_compression_api.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'ZSTD_fillHashTableForCDict', 'MEM_writeLE16', 'ZSTD_freeCCtx', 'ZSTD_CCtx_init_compressStream2', 'ZSTD_isLegacy', 'MEM_readLE64']

tests/fuzz/block_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ZSTD_hash8', 'ZSTD_execSequenceEnd', 'ZSTD_compressContinue_internal', 'ZSTD_minGain', 'BIT_reloadDStream_internal', 'ZSTD_isAligned', 'ZSTD_safecopyLiterals', 'ZSTD_buildSequencesStatistics', 'ZSTD_entropyCompressSeqStore_wExtLitBuffer', 'ZSTD_freeCCtxContent']