High level conclusions

Fuzzers reach 64.04% code coverage.

Fuzzers reach 31.84% of cyclomatic complexity.

Fuzzers reach 58.93% of all functions.

Fuzzer dictionary_loader is blocked:

The runtime code coverage of dictionary_loader covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer simple_compress is blocked:

The runtime code coverage of simple_compress covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer simple_round_trip is blocked:

The runtime code coverage of simple_round_trip covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer decompress_dstSize_tooSmall is blocked:

The runtime code coverage of decompress_dstSize_tooSmall covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer decompress_cross_format is blocked:

The runtime code coverage of decompress_cross_format covers 25.37% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer seekable_roundtrip is blocked:

The runtime code coverage of seekable_roundtrip covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1026 / 1741

Cyclomatic complexity statically reachable by fuzzers

7342 / 23057

Runtime code coverage of functions

1115 / 1741

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: seekable_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4359	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	4359	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4358	0	EP	call site: 00000	ZSTD_seekable_compressStream

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

914

Reachable functions

914

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/seekable_roundtrip.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	147
tests/fuzz/../../contrib/seekable_format/zstdseek_compress.c	12
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	54
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
tests/fuzz/../../contrib/seekable_format/zstdseek_decompress.c	8
lib/decompress/zstd_decompress.c	53
lib/decompress/../common/allocations.h	3
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/common/xxhash.h	16
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	16
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	5
lib/decompress/../common/error_private.h	1
lib/common/error_private.c	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	32
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: huf_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	31.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	204	68.9%
All colors	296	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	188	BIT_reloadDStream_internal	call site: 00188	HUF_decompress1X2_usingDTable_internal_default
24	213	HUF_decompress1X_usingDTable	call site: 00213	HUF_decompress1X1_usingDTable_internal_bmi2
14	95	BIT_readBitsFast	call site: 00095	FSE_initDState
7	84	FSE_initDState	call site: 00084	BIT_reloadDStream_internal
6	181	BIT_initDStream	call site: 00181	BIT_reloadDStream_internal
3	75	BIT_initDStream	call site: 00075	FSE_initDState
2	42	MEM_readLE32	call site: 00042	MEM_read32
2	71	MEM_readLE64	call site: 00071	MEM_read64
2	164	HUF_decompress1X_usingDTable	call site: 00164	HUF_decompress1X2_usingDTable_internal_bmi2
2	171	MEM_readLE32	call site: 00171	MEM_read32
2	176	MEM_readLE64	call site: 00176	MEM_read64
1	7	FUZZ_dataProducer_int32Range	call site: 00007	FUZZ_dataProducer_uint32Range

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

7

Reachable functions

84

Percentage of reachable functions covered

91.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/common/cpu.h	2
lib/decompress/huf_decompress.c	26
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	1
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/mem.h	13
lib/common/zstd_common.c	1
lib/decompress/../common/bitstream.h	4
lib/decompress/../common/bits.h	3
lib/decompress/../common/compiler.h	1

Fuzzer: huf_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	21.0%
gold	[1:9]	5	0.83%
yellow	[10:29]	2	0.33%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	465	77.7%
All colors	598	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	380	HUF_compress1X_usingCTable_internal_bmi2	call site: 00380	MEM_writeLEST
24	456	BIT_reloadDStream_internal	call site: 00456	HUF_decompress1X2_usingDTable_internal_default
24	481	HUF_decompress1X_usingDTable	call site: 00481	HUF_decompress1X1_usingDTable_internal_bmi2
14	295	BIT_readBitsFast	call site: 00295	FSE_initDState
6	285	FSE_initDState	call site: 00285	BIT_reloadDStream_internal
6	449	BIT_initDStream	call site: 00449	BIT_reloadDStream_internal
5	176	MEM_writeLEST	call site: 00176	MEM_writeLE32
2	40	LLVMFuzzerTestOneInput	call site: 00040	ERR_getErrorName
2	184	MEM_writeLE64	call site: 00184	MEM_swap64
2	247	MEM_readLE32	call site: 00247	MEM_read32
2	273	MEM_readLE64	call site: 00273	MEM_read64
2	277	BIT_initDStream	call site: 00277	FSE_initDState

Runtime coverage analysis

Covered functions

175

Functions that are reachable but not covered

13

Reachable functions

158

Percentage of reachable functions covered

91.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/huf_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/common/cpu.h	2
lib/compress/hist.c	5
lib/compress/../common/mem.h	13
lib/common/zstd_common.c	2
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/common/bits.h	3
lib/compress/huf_compress.c	35
lib/compress/fse_compress.c	11
lib/compress/../common/bits.h	2
lib/compress/../common/error_private.h	1
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	4
lib/decompress/huf_decompress.c	26
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/mem.h	13
lib/decompress/../common/bitstream.h	4
lib/decompress/../common/bits.h	3
lib/decompress/../common/compiler.h	1

Fuzzer: decompress_cross_format

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1833	76.7%
gold	[1:9]	3	0.12%
yellow	[10:29]	5	0.20%
greenyellow	[30:49]	1	0.04%
lawngreen	50+	545	22.8%
All colors	2387	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
336	863	MEM_readLE16	call site: 00863	ZSTDv07_decompress_usingDict
243	217	ZSTD_decompressMultiFrame	call site: 00217	ZSTD_decompressLegacy
214	1200	ZSTD_XXH64_reset	call site: 01200	ZSTDv07_decompressBlock_internal
157	551	BIT_reloadDStream	call site: 00551	ZSTDv05_decompress_usingDict
148	713	MEM_readLE64	call site: 00713	ZSTDv05_decompress_continueDCtx
117	2120	ZSTD_decompressStream	call site: 02120	ZSTD_decompressLegacyStream
88	461	BIT_reloadDStream	call site: 00461	ZSTDv03_decompress
49	20	MEM_readLE32	call site: 00020	ZSTD_findFrameSizeInfoLegacy
41	71	MEM_readLE32	call site: 00071	ZSTDv07_findFrameSizeInfoLegacy
41	2240	ZSTD_decompressStream	call site: 02240	ZSTD_decompressLegacyStream
40	1959	ZSTD_execSequenceEndSplitLitBuffer	call site: 01959	ZSTD_decompressSequencesLong_default
29	1886	BIT_readBitsFast	call site: 01886	BIT_reloadDStream_internal

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

297

Reachable functions

398

Percentage of reachable functions covered

25.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_cross_format.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	51
lib/decompress/../legacy/zstd_legacy.h	8
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	67
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	30
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/common/error_private.c	1
lib/common/xxhash.h	16
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: sequence_compression_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2324	67.6%
gold	[1:9]	77	2.24%
yellow	[10:29]	4	0.11%
greenyellow	[30:49]	1	0.02%
lawngreen	50+	1027	29.9%
All colors	3433	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
581	2244	MEM_readLE16	call site: 02244	ZSTDv07_decompress_usingDict
281	1560	MEM_readLE32	call site: 01560	ZSTD_decompressLegacy
157	1932	BIT_reloadDStream	call site: 01932	ZSTDv05_decompress_usingDict
136	421	ZSTD_fillHashTableForCDict	call site: 00421	ZSTD_updateTree
108	2134	MEM_writeLE16	call site: 02134	ZSTDv05_decompress_continueDCtx
88	1842	BIT_reloadDStream	call site: 01842	ZSTDv03_decompress
79	1017	ZSTD_freeCCtx	call site: 01017	ZSTDMT_initCStream_internal
74	917	ZSTD_CCtx_init_compressStream2	call site: 00917	ZSTDMT_createCCtx_advanced
48	1510	ZSTD_isLegacy	call site: 01510	ZSTD_findFrameCompressedSizeLegacy
38	2094	MEM_readLE64	call site: 02094	FSEv05_initDState
33	325	ZSTD_window_update	call site: 00325	ZSTD_ldm_fillHashTable
32	1265	MEM_writeLE24	call site: 01265	ZSTD_convertBlockSequences

Runtime coverage analysis

Covered functions

431

Functions that are reachable but not covered

163

Reachable functions

452

Percentage of reachable functions covered

63.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/sequence_compression_api.c	8
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	103
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	1
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	31
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	36
lib/decompress/../common/allocations.h	3
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	38
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	8
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	5
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	10
lib/decompress/zstd_ddict.c	9
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/common/zstd_common.c	3
lib/common/error_private.c	1
lib/common/pool.c	6
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_compress_literals.c	5
lib/compress/hist.c	3
lib/compress/zstd_compress_sequences.c	11
lib/compress/../common/fse.h	5
lib/compress/../common/bitstream.h	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: simple_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	815	39.1%
gold	[1:9]	6	0.28%
yellow	[10:29]	10	0.48%
greenyellow	[30:49]	9	0.43%
lawngreen	50+	1243	59.6%
All colors	2083	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	349	FSE_buildDTable	call site: 00349	ZSTD_decodeSequence
54	439	FSE_buildDTable	call site: 00439	ZSTD_decodeSequence
41	1909	ZSTD_execSequenceEndSplitLitBuffer	call site: 01909	ZSTD_decompressSequencesSplitLitBuffer
33	1832	ZSTD_initFseState	call site: 01832	BIT_reloadDStream_internal
31	1479	BIT_reloadDStream_internal	call site: 01479	FSE_decompress_wksp_body_default
26	1661	HUF_decompress1X_usingDTable	call site: 01661	HUF_decompress4X_usingDTable
25	1774	HUF_decompress4X1_DCtx_wksp	call site: 01774	ZSTD_buildSeqTable
25	1804	ZSTD_buildSeqTable	call site: 01804	ZSTD_decompressSequencesLong
24	1636	BIT_reloadDStream_internal	call site: 01636	HUF_decompress1X2_usingDTable_internal_default
19	1077	HUFv07_fillDTableX4	call site: 01077	FSEv07_readNCount
18	1887	ZSTD_execSequenceEnd	call site: 01887	ZSTD_execSequenceEndSplitLitBuffer
18	2064	LLVMFuzzerTestOneInput	call site: 02064	ZSTD_freeLegacyStreamContext

Runtime coverage analysis

Covered functions

455

Functions that are reachable but not covered

8

Reachable functions

94

Percentage of reachable functions covered

91.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	36
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/common/xxhash.h	16
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	2
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3
lib/common/zstd_common.c	2

Fuzzer: dictionary_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1569	42.2%
gold	[1:9]	10	0.26%
yellow	[10:29]	14	0.37%
greenyellow	[30:49]	1	0.02%
lawngreen	50+	2119	57.0%
All colors	3713	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
135	417	ZSTD_fillHashTableForCDict	call site: 00417	ZSTD_updateTree
62	1535	ZSTD_minGain	call site: 01535	ZSTD_compressBlock_splitBlock
54	2204	FSE_buildDTable	call site: 02204	ZSTD_decodeSequence
54	2294	FSE_buildDTable	call site: 02294	ZSTD_decodeSequence
40	970	ZSTD_XXH64_update	call site: 00970	ZSTD_compressBlock_targetCBlockSize
38	1052	ZSTD_safecopyLiterals	call site: 01052	ZSTD_ldm_blockCompress
36	1364	ZSTD_buildSequencesStatistics	call site: 01364	ZSTD_compressSubBlock_multi
35	1630	ZSTD_entropyCompressSeqStore_wExtLitBuffer	call site: 01630	ZSTD_compressBlock_internal
32	3494	ZSTD_initFseState	call site: 03494	BIT_reloadDStream_internal
31	1302	ZSTD_buildSequencesStatistics	call site: 01302	ZSTD_NCountCost
30	1741	ZSTD_freeCCtxContent	call site: 01741	ZSTDMT_freeCCtxPool
27	1506	ZSTD_encodeSequences_bmi2	call site: 01506	ZSTD_compressSubBlock

Runtime coverage analysis

Covered functions

748

Functions that are reachable but not covered

180

Reachable functions

777

Percentage of reachable functions covered

76.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_decompress.c	1
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	1
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress.c	129
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/error_private.h	1
lib/compress/../common/bits.h	7
lib/compress/zstd_cwksp.h	35
lib/compress/../common/compiler.h	1
lib/compress/../common/allocations.h	2
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	10
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/common/zstd_common.c	3
lib/decompress/zstd_ddict.c	10
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/common/error_private.c	1
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: raw_dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2032	49.3%
gold	[1:9]	4	0.09%
yellow	[10:29]	4	0.09%
greenyellow	[30:49]	5	0.12%
lawngreen	50+	2075	50.3%
All colors	4120	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3034	MEM_readLE16	call site: 03034	ZSTDv07_decompress_usingDict
281	2350	MEM_readLE32	call site: 02350	ZSTD_decompressLegacy
157	2722	BIT_reloadDStream	call site: 02722	ZSTDv05_decompress_usingDict
108	2924	MEM_writeLE16	call site: 02924	ZSTDv05_decompress_continueDCtx
88	2632	BIT_reloadDStream	call site: 02632	ZSTDv03_decompress
61	3989	ZSTD_decompressSequencesLong_bmi2	call site: 03989	ZSTD_decompressSequencesSplitLitBuffer
48	2300	ZSTD_isLegacy	call site: 02300	ZSTD_findFrameCompressedSizeLegacy
38	2884	MEM_readLE64	call site: 02884	FSEv05_initDState
29	1392	ZSTD_compress_frameChunk	call site: 01392	ZSTD_splitBlock
27	3961	ZSTD_assertValidSequence	call site: 03961	ZSTD_execSequenceEndSplitLitBuffer
26	971	ZSTDMT_initCStream_internal	call site: 00971	ZSTDMT_resize
25	1809	HUF_compress1X_usingCTable_internal_bmi2	call site: 01809	MEM_writeLEST

Runtime coverage analysis

Covered functions

752

Functions that are reachable but not covered

83

Reachable functions

595

Percentage of reachable functions covered

86.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/raw_dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	147
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	53
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: decompress_dstSize_tooSmall

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3485	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	3485	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3484	0	EP	call site: 00000	ZSTD_compressCCtx

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

461

Reachable functions

461

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/decompress_dstSize_tooSmall.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	118
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	10
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	31
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	3
lib/common/error_private.c	1
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	30
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1

Fuzzer: dictionary_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1963	45.0%
gold	[1:9]	5	0.11%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.06%
lawngreen	50+	2383	54.7%
All colors	4354	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3268	MEM_readLE16	call site: 03268	ZSTDv07_decompress_usingDict
281	2584	MEM_readLE32	call site: 02584	ZSTD_decompressLegacy
157	2956	BIT_reloadDStream	call site: 02956	ZSTDv05_decompress_usingDict
108	3158	MEM_writeLE16	call site: 03158	ZSTDv05_decompress_continueDCtx
88	2866	BIT_reloadDStream	call site: 02866	ZSTDv03_decompress
48	2534	ZSTD_isLegacy	call site: 02534	ZSTD_findFrameCompressedSizeLegacy
38	3118	MEM_readLE64	call site: 03118	FSEv05_initDState
27	4195	ZSTD_assertValidSequence	call site: 04195	ZSTD_execSequenceEndSplitLitBuffer
26	2101	ZSTDMT_initCStream_internal	call site: 02101	ZSTDMT_resize
25	1427	HUF_compress1X_usingCTable_internal_bmi2	call site: 01427	MEM_writeLEST
25	4128	BIT_readBitsFast	call site: 04128	BIT_reloadDStream_internal
24	3939	BIT_reloadDStream_internal	call site: 03939	HUF_decompress1X2_usingDTable_internal_default

Runtime coverage analysis

Covered functions

822

Functions that are reachable but not covered

66

Reachable functions

632

Percentage of reachable functions covered

89.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	8
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	158
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	53
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2298	52.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	9	0.20%
greenyellow	[30:49]	8	0.18%
lawngreen	50+	2088	47.4%
All colors	4403	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
535	2531	MEM_readLE16	call site: 02531	ZBUFFv07_decompressContinue
242	3358	ZSTD_decompressMultiFrame	call site: 03358	ZSTD_decompressLegacy
121	2254	ZSTD_decompressStream	call site: 02254	ZSTD_decompressLegacyStream
107	2422	MEM_readLE64	call site: 02422	ZSTDv05_decompressSequences
98	3691	BIT_reloadDStream	call site: 03691	ZSTDv07_decompress_usingDict
93	3161	MEM_writeLE16	call site: 03161	ZSTD_decompressLegacyStream
89	4158	ZSTD_assertValidSequence	call site: 04158	ZSTD_decompressSequencesSplitLitBuffer
88	3601	BIT_reloadDStream	call site: 03601	ZSTDv03_decompress
73	3261	ZSTD_findFrameSizeInfo	call site: 03261	ZSTD_findFrameSizeInfoLegacy
42	3117	ZSTD_getDDict	call site: 03117	ZSTD_initLegacyStream
40	2377	MEM_readLE32	call site: 02377	ZSTDv05_decompressContinue
32	4091	BIT_readBitsFast	call site: 04091	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

715

Functions that are reachable but not covered

356

Reachable functions

874

Percentage of reachable functions covered

59.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_round_trip.c	5
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	145
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	53
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	50
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/decompress/../common/mem.h	16
lib/decompress/zstd_ddict.c	5
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	32
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: block_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	293	48.9%
gold	[1:9]	3	0.50%
yellow	[10:29]	1	0.16%
greenyellow	[30:49]	1	0.16%
lawngreen	50+	300	50.1%
All colors	598	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	83	BIT_lookBitsFast	call site: 00083	HUF_decompress4X_usingDTable
40	473	ZSTD_execSequenceEndSplitLitBuffer	call site: 00473	ZSTD_decompressSequencesLong_default
29	400	BIT_readBitsFast	call site: 00400	BIT_reloadDStream_internal
19	253	BIT_readBitsFast	call site: 00253	FSE_decompress_wksp_body_default
18	451	ZSTD_execSequenceEnd	call site: 00451	ZSTD_execSequenceEndSplitLitBuffer
13	380	ZSTD_decompressBlock_internal	call site: 00380	ZSTD_decompressSequencesLong
13	583	ZSTD_freeDCtx	call site: 00583	ZSTD_freeLegacyStreamContext
12	530	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00530	ZSTD_execSequenceEnd
8	7	FUZZ_malloc_rand	call site: 00007	FUZZ_dataProducer_int32Range
8	521	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00521	ZSTD_execSequenceEndSplitLitBuffer
8	543	ZSTD_decompressSequencesSplitLitBuffer_bmi2	call site: 00543	ZSTD_decompressSequencesSplitLitBuffer_default
8	559	ZSTD_decompressSequences_bmi2	call site: 00559	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

136

Functions that are reachable but not covered

19

Reachable functions

58

Percentage of reachable functions covered

67.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_decompress.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_decompress_block.c	31
lib/decompress/../common/mem.h	14
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/compiler.h	3
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/error_private.h	1
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Fuzzer: fse_read_ncount

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	21.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.33%
lawngreen	50+	58	77.3%
All colors	75	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	27	LLVMFuzzerTestOneInput	call site: 00027	ERR_getErrorName
4	45	MEM_readLE32	call site: 00045	ZSTD_countTrailingZeros32
3	38	FSE_readNCount	call site: 00038	FSE_readNCount_body_bmi2
1	12	FUZZ_dataProducer_int32Range	call site: 00012	FUZZ_dataProducer_uint32Range
1	20	FSE_writeNCount	call site: 00020	FSE_writeNCount_generic
1	42	FSE_isError	call site: 00042	MEM_readLE32
1	50	ZSTD_countTrailingZeros32	call site: 00050	ZSTD_highbit32
1	73	LLVMFuzzerTestOneInput	call site: 00073	FUZZ_dataProducer_free

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

9

Reachable functions

24

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fse_read_ncount.c	1
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	1
lib/compress/fse_compress.c	3
lib/common/zstd_common.c	2
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/common/entropy_common.c	5
lib/common/mem.h	4
lib/common/bits.h	3

Fuzzer: generate_sequences

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2573	61.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1587	38.1%
All colors	4162	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3022	MEM_readLE16	call site: 03022	ZSTDv07_decompress_usingDict
281	2338	MEM_readLE32	call site: 02338	ZSTD_decompressLegacy
157	2710	BIT_reloadDStream	call site: 02710	ZSTDv05_decompress_usingDict
108	2912	MEM_writeLE16	call site: 02912	ZSTDv05_decompress_continueDCtx
89	3991	ZSTD_assertValidSequence	call site: 03991	ZSTD_decompressSequencesSplitLitBuffer
88	2620	BIT_reloadDStream	call site: 02620	ZSTDv03_decompress
77	938	ZSTD_freeCCtx	call site: 00938	ZSTDMT_initCStream_internal
75	837	ZSTD_CCtx_init_compressStream2	call site: 00837	ZSTDMT_createCCtx_advanced
63	1168	ZSTD_compressStream2	call site: 01168	ZSTDMT_compressStream_generic
54	2094	ZSTD_compressEnd_public	call site: 02094	ZSTD_compressContinue_public
50	2286	MEM_readLE32	call site: 02286	ZSTD_findFrameCompressedSizeLegacy
40	609	ZSTD_isAligned	call site: 00609	ZSTD_updateTree

Runtime coverage analysis

Covered functions

576

Functions that are reachable but not covered

184

Reachable functions

570

Percentage of reachable functions covered

67.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/generate_sequences.c	2
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	154
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	53
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	31
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/../common/error_private.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: dictionary_stream_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1923	44.2%
gold	[1:9]	2	0.04%
yellow	[10:29]	5	0.11%
greenyellow	[30:49]	11	0.25%
lawngreen	50+	2401	55.2%
All colors	4342	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
561	3256	MEM_readLE16	call site: 03256	ZSTDv07_decompress_usingDict
281	2572	MEM_readLE32	call site: 02572	ZSTD_decompressLegacy
157	2944	BIT_reloadDStream	call site: 02944	ZSTDv05_decompress_usingDict
108	3146	MEM_writeLE16	call site: 03146	ZSTDv05_decompress_continueDCtx
88	2854	BIT_reloadDStream	call site: 02854	ZSTDv03_decompress
61	4211	ZSTD_decompressSequencesLong_bmi2	call site: 04211	ZSTD_decompressSequencesSplitLitBuffer
48	2522	ZSTD_isLegacy	call site: 02522	ZSTD_findFrameCompressedSizeLegacy
38	3106	MEM_readLE64	call site: 03106	FSEv05_initDState
32	4142	ZSTD_decompressSequencesLong_bmi2	call site: 04142	ZSTD_execSequenceEnd
29	978	ZSTD_compress_frameChunk	call site: 00978	ZSTD_splitBlock
27	4183	ZSTD_assertValidSequence	call site: 04183	ZSTD_execSequenceEndSplitLitBuffer
25	1426	HUF_compress1X_usingCTable_internal_bmi2	call site: 01426	MEM_writeLEST

Runtime coverage analysis

Covered functions

805

Functions that are reachable but not covered

62

Reachable functions

627

Percentage of reachable functions covered

90.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_stream_round_trip.c	4
tests/fuzz/fuzz_data_producer.c	5
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	154
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	53
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	7
lib/dictBuilder/fastcover.c	9
lib/dictBuilder/cover.c	3
lib/dictBuilder/../compress/zstd_compress_internal.h	4
lib/dictBuilder/../common/mem.h	7
lib/dictBuilder/../common/error_private.h	1
lib/dictBuilder/zdict.c	8
lib/common/xxhash.h	16
lib/dictBuilder/../common/bits.h	2
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/pool.c	9
lib/common/threading.c	4
lib/common/../common/allocations.h	2
lib/common/zstd_common.c	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: stream_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	824	35.2%
gold	[1:9]	13	0.55%
yellow	[10:29]	19	0.81%
greenyellow	[30:49]	9	0.38%
lawngreen	50+	1474	63.0%
All colors	2339	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	1439	FSE_buildDTable	call site: 01439	ZSTD_decodeSequence
54	1529	FSE_buildDTable	call site: 01529	ZSTD_decodeSequence
32	2062	ZSTD_initFseState	call site: 02062	BIT_reloadDStream_internal
31	1743	BIT_reloadDStream_internal	call site: 01743	FSE_decompress_wksp_body_default
31	2276	ZSTD_decompressContinueStream	call site: 02276	ZSTD_decompressBlock_internal
26	951	ZSTD_getFrameHeader_advanced	call site: 00951	ZSTD_DCtx_selectFrameDDict
26	1092	ZSTDv07_decompressBegin_usingDict	call site: 01092	ZSTDv07_decompress_insertDictionary
26	1893	HUF_decompress1X_usingDTable	call site: 01893	HUF_decompress4X_usingDTable
24	1868	BIT_reloadDStream_internal	call site: 01868	HUF_decompress1X2_usingDTable_internal_default
24	2006	HUF_decompress4X1_DCtx_wksp	call site: 02006	ZSTD_buildSeqTable
21	2159	ZSTD_decompressSequencesLong_bmi2	call site: 02159	ZSTD_decompressSequencesSplitLitBuffer
19	2139	ZSTD_execSequenceEndSplitLitBuffer	call site: 02139	ZSTD_execSequenceEnd

Runtime coverage analysis

Covered functions

522

Functions that are reachable but not covered

36

Reachable functions

407

Percentage of reachable functions covered

91.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/stream_decompress.c	3
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/decompress/zstd_decompress.c	50
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	4
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	5
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/decompress/../common/error_private.h	1
lib/decompress/../legacy/zstd_legacy.h	8
lib/legacy/zstd_v04.c	67
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v05.c	72
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	83
lib/legacy/zstd_v07.c	95
lib/common/xxhash.h	16
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/decompress/zstd_decompress_block.c	30
lib/decompress/huf_decompress.c	31
lib/common/entropy_common.c	8
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: zstd_frame_info

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	52	24.8%
gold	[1:9]	2	0.95%
yellow	[10:29]	7	3.34%
greenyellow	[30:49]	2	0.95%
lawngreen	50+	146	69.8%
All colors	209	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	3	ZSTD_isLegacy	call site: 00003	MEM_isLittleEndian
4	11	ZSTDv05_getFrameParams	call site: 00011	MEM_isLittleEndian
4	17	ZSTDv06_getFrameParams	call site: 00017	MEM_isLittleEndian
4	26	ZSTDv06_getFrameParams	call site: 00026	MEM_isLittleEndian
4	34	MEM_readLE32	call site: 00034	MEM_readLE32
4	80	ZSTD_getFrameHeader_advanced	call site: 00080	MEM_isLittleEndian
3	104	ZSTDv02_findFrameSizeInfoLegacy	call site: 00104	MEM_isLittleEndian
3	115	ZSTDv03_findFrameSizeInfoLegacy	call site: 00115	MEM_isLittleEndian
3	126	ZSTDv04_findFrameSizeInfoLegacy	call site: 00126	MEM_isLittleEndian
2	23	ZSTDv06_getFrameParams	call site: 00023	MEM_isLittleEndian
2	50	MEM_readLE64	call site: 00050	MEM_read64
2	59	MEM_writeLE32	call site: 00059	MEM_swap32

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

3

Reachable functions

56

Percentage of reachable functions covered

94.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/zstd_frame_info.c	1
lib/decompress/zstd_decompress.c	16
lib/decompress/../legacy/zstd_legacy.h	3
lib/decompress/../common/mem.h	12
lib/legacy/zstd_v05.c	5
lib/legacy/../common/mem.h	4
lib/legacy/zstd_v06.c	14
lib/legacy/zstd_v07.c	15
lib/legacy/zstd_v01.c	5
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	7
lib/legacy/zstd_v03.c	7
lib/legacy/zstd_v04.c	7
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	1

Fuzzer: simple_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4178	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	4178	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4177	0	EP	call site: 00000	ZSTD_compress2

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

604

Reachable functions

604

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_round_trip.c	3
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	152
tests/fuzz/fuzz_data_producer.c	8
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	53
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	37
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
tests/fuzz/zstd_helpers.c	6
lib/compress/../common/mem.h	19
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/bits.h	7
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
tests/fuzz/../../contrib/externalSequenceProducer/sequence_producer.c	1
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_ddict.c	5
lib/decompress/../legacy/zstd_legacy.h	6
lib/decompress/../common/mem.h	16
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/huf_decompress.c	31
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: simple_compress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1605	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1605	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1604	0	EP	call site: 00000	ZSTD_compressCCtx

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

439

Reachable functions

439

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/simple_compress.c	1
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	1
lib/compress/zstd_compress.c	118
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	10
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	2
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/common/zstd_common.c	2
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1

Fuzzer: dictionary_loader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4019	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	4019	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4018	0	EP	call site: 00000	compress

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

582

Reachable functions

582

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/dictionary_loader.c	3
tests/fuzz/fuzz_data_producer.c	4
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	141
lib/compress/../common/allocations.h	3
lib/compress/../common/zstd_internal.h	4
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	53
lib/compress/zstd_cwksp.h	35
lib/compress/../common/error_private.h	1
lib/common/zstd_common.c	3
lib/common/error_private.h	3
lib/common/error_private.c	1
lib/compress/zstd_compress_internal.h	47
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/../common/compiler.h	1
lib/compress/zstd_ldm.c	20
lib/common/xxhash.h	16
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/pool.c	9
lib/common/../common/allocations.h	2
lib/common/threading.c	4
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress.c	33
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/decompress/zstd_ddict.c	8
lib/decompress/../common/mem.h	16
lib/decompress/huf_decompress.c	31
lib/decompress/../common/error_private.h	1
lib/decompress/zstd_decompress_block.c	32
lib/decompress/../common/bits.h	3
lib/decompress/../legacy/zstd_legacy.h	6
lib/legacy/zstd_v01.c	57
lib/legacy/../common/error_private.h	1
lib/legacy/zstd_v02.c	46
lib/legacy/zstd_v03.c	46
lib/legacy/zstd_v04.c	55
lib/legacy/zstd_v05.c	66
lib/legacy/../common/mem.h	14
lib/legacy/zstd_v06.c	77
lib/legacy/zstd_v07.c	87
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/compiler.h	3

Fuzzer: block_round_trip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1112	53.0%
gold	[1:9]	10	0.47%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	974	46.4%
All colors	2097	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
75	453	ZSTD_hash8	call site: 00453	ZSTD_row_update
69	1878	ZSTD_execSequenceEnd	call site: 01878	ZSTD_decompressSequencesLong_default
63	815	ZSTD_compressContinue_internal	call site: 00815	ZSTD_compress_frameChunk
62	1403	ZSTD_minGain	call site: 01403	ZSTD_compressBlock_splitBlock
50	1605	BIT_reloadDStream_internal	call site: 01605	HUF_decompress4X_usingDTable
40	544	ZSTD_isAligned	call site: 00544	ZSTD_updateTree
38	920	ZSTD_safecopyLiterals	call site: 00920	ZSTD_ldm_blockCompress
36	1232	ZSTD_buildSequencesStatistics	call site: 01232	ZSTD_compressSubBlock_multi
35	1498	ZSTD_entropyCompressSeqStore_wExtLitBuffer	call site: 01498	ZSTD_compressBlock_internal
34	365	ZSTD_window_update	call site: 00365	ZSTD_overflowCorrectIfNeeded
30	2029	ZSTD_freeCCtxContent	call site: 02029	ZSTDMT_freeCCtxPool
29	1828	BIT_readBitsFast	call site: 01828	BIT_reloadDStream_internal

Runtime coverage analysis

Covered functions

444

Functions that are reachable but not covered

185

Reachable functions

463

Percentage of reachable functions covered

60.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/block_round_trip.c	2
tests/fuzz/fuzz_data_producer.c	6
tests/fuzz/fuzz_helpers.c	2
lib/compress/zstd_compress.c	118
lib/compress/../common/allocations.h	2
lib/compress/../common/zstd_internal.h	3
lib/compress/../common/cpu.h	3
lib/compress/zstdmt_compress.c	10
lib/compress/zstd_cwksp.h	34
lib/compress/../common/error_private.h	1
lib/decompress/zstd_decompress.c	9
lib/decompress/../common/allocations.h	2
lib/decompress/../common/zstd_internal.h	3
lib/decompress/../common/cpu.h	3
lib/compress/zstd_compress_internal.h	42
lib/compress/../common/mem.h	19
lib/compress/../common/bits.h	7
lib/compress/zstd_ldm.c	20
lib/compress/../common/compiler.h	1
lib/common/xxhash.h	15
lib/compress/zstd_fast.c	3
lib/compress/zstd_double_fast.c	3
lib/compress/zstd_lazy.c	4
lib/compress/zstd_opt.c	2
lib/compress/huf_compress.c	37
lib/common/entropy_common.c	9
lib/common/fse_decompress.c	4
lib/common/error_private.h	3
lib/common/mem.h	10
lib/common/bits.h	3
lib/common/bitstream.h	4
lib/common/fse.h	3
lib/compress/fse_compress.c	12
lib/common/zstd_common.c	2
lib/common/error_private.c	1
lib/compress/zstd_preSplit.c	8
lib/compress/hist.c	5
lib/compress/zstd_compress_superblock.c	13
lib/compress/../common/bitstream.h	6
lib/compress/../common/fse.h	5
lib/compress/zstd_compress_sequences.c	11
lib/compress/zstd_compress_literals.c	5
lib/decompress/zstd_decompress_block.c	33
lib/decompress/../common/mem.h	14
lib/decompress/zstd_decompress_internal.h	1
lib/decompress/huf_decompress.c	31
lib/decompress/../common/bitstream.h	5
lib/decompress/../common/bits.h	3
lib/decompress/../common/error_private.h	1
lib/decompress/../common/compiler.h	3
lib/common/pool.c	2
lib/common/threading.c	2
lib/common/../common/allocations.h	1
lib/decompress/zstd_ddict.c	1
lib/decompress/../legacy/zstd_legacy.h	1
lib/legacy/zstd_v04.c	3
lib/legacy/zstd_v05.c	2
lib/legacy/zstd_v06.c	2
lib/legacy/zstd_v07.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
ZSTD_compressBlock_btlazy2_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	4574
ZSTD_decompressSequencesLong	/src/zstd/lib/decompress/zstd_decompress_block.c	7	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'int', 'int']	6	0	60	8	3	36	0	759	707
ZDICT_trainFromBuffer_legacy	/src/zstd/lib/dictBuilder/zdict.c	6	['N/A', 'size_t', 'N/A', 'N/A', 'int', 'N/A']	25	0	74	8	4	494	0	3892	696
ZSTD_compressBlock_lazy2_extDict_row	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_lazy2_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_lazy_extDict_row	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_lazy_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_greedy_extDict_row	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_compressBlock_greedy_extDict	/src/zstd/lib/compress/zstd_lazy.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	8	0	5341	703	665	108	0	4681	665
ZSTD_decompressSequencesSplitLitBuffer	/src/zstd/lib/decompress/zstd_decompress_block.c	7	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'int', 'int']	6	0	60	8	3	34	0	559	431

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1168 / 1741

Cyclomatic complexity statically reachable by fuzzers

17740 / 23057

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzz/seekable_roundtrip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/huf_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['BIT_reloadDStream_internal', 'HUF_decompress1X_usingDTable', 'BIT_readBitsFast', 'FSE_initDState', 'BIT_initDStream', 'MEM_readLE32', 'MEM_readLE64']

tests/fuzz/huf_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['HUF_compress1X_usingCTable_internal_bmi2', 'BIT_reloadDStream_internal', 'HUF_decompress1X_usingDTable', 'BIT_readBitsFast', 'FSE_initDState', 'BIT_initDStream', 'MEM_writeLEST', 'LLVMFuzzerTestOneInput', 'MEM_writeLE64', 'MEM_readLE32']

tests/fuzz/decompress_cross_format.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'ZSTD_decompressMultiFrame', 'ZSTD_XXH64_reset', 'BIT_reloadDStream', 'MEM_readLE64', 'ZSTD_decompressStream', 'MEM_readLE32']

tests/fuzz/sequence_compression_api.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'ZSTD_fillHashTableForCDict', 'MEM_writeLE16', 'ZSTD_freeCCtx', 'ZSTD_CCtx_init_compressStream2', 'ZSTD_isLegacy', 'MEM_readLE64']

tests/fuzz/simple_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['FSE_buildDTable', 'ZSTD_execSequenceEndSplitLitBuffer', 'ZSTD_initFseState', 'BIT_reloadDStream_internal', 'HUF_decompress1X_usingDTable', 'HUF_decompress4X1_DCtx_wksp', 'ZSTD_buildSeqTable', 'HUFv07_fillDTableX4']

tests/fuzz/dictionary_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ZSTD_fillHashTableForCDict', 'ZSTD_minGain', 'FSE_buildDTable', 'ZSTD_XXH64_update', 'ZSTD_safecopyLiterals', 'ZSTD_buildSequencesStatistics', 'ZSTD_entropyCompressSeqStore_wExtLitBuffer', 'ZSTD_initFseState']

tests/fuzz/raw_dictionary_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_decompressSequencesLong_bmi2', 'ZSTD_isLegacy', 'MEM_readLE64', 'ZSTD_compress_frameChunk', 'ZSTD_assertValidSequence']

tests/fuzz/decompress_dstSize_tooSmall.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/dictionary_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_isLegacy', 'MEM_readLE64', 'ZSTD_assertValidSequence', 'ZSTDMT_initCStream_internal', 'HUF_compress1X_usingCTable_internal_bmi2']

tests/fuzz/stream_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'ZSTD_decompressMultiFrame', 'ZSTD_decompressStream', 'MEM_readLE64', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_assertValidSequence', 'ZSTD_findFrameSizeInfo', 'ZSTD_getDDict']

tests/fuzz/block_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['BIT_lookBitsFast', 'ZSTD_execSequenceEndSplitLitBuffer', 'BIT_readBitsFast', 'ZSTD_execSequenceEnd', 'ZSTD_decompressBlock_internal', 'ZSTD_freeDCtx', 'ZSTD_decompressSequencesSplitLitBuffer_bmi2', 'FUZZ_malloc_rand']

tests/fuzz/fse_read_ncount.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'MEM_readLE32', 'FSE_readNCount', 'FUZZ_dataProducer_int32Range', 'FSE_writeNCount', 'FSE_isError', 'ZSTD_countTrailingZeros32']

tests/fuzz/generate_sequences.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_assertValidSequence', 'ZSTD_freeCCtx', 'ZSTD_CCtx_init_compressStream2', 'ZSTD_compressStream2', 'ZSTD_compressEnd_public']

tests/fuzz/dictionary_stream_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MEM_readLE16', 'MEM_readLE32', 'BIT_reloadDStream', 'MEM_writeLE16', 'ZSTD_decompressSequencesLong_bmi2', 'ZSTD_isLegacy', 'MEM_readLE64', 'ZSTD_compress_frameChunk']

tests/fuzz/stream_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['FSE_buildDTable', 'ZSTD_initFseState', 'BIT_reloadDStream_internal', 'ZSTD_decompressContinueStream', 'ZSTD_getFrameHeader_advanced', 'ZSTDv07_decompressBegin_usingDict', 'HUF_decompress1X_usingDTable', 'HUF_decompress4X1_DCtx_wksp']

tests/fuzz/zstd_frame_info.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ZSTD_isLegacy', 'ZSTDv05_getFrameParams', 'ZSTDv06_getFrameParams', 'MEM_readLE32', 'ZSTD_getFrameHeader_advanced', 'ZSTDv02_findFrameSizeInfoLegacy', 'ZSTDv03_findFrameSizeInfoLegacy', 'ZSTDv04_findFrameSizeInfoLegacy']

tests/fuzz/simple_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/simple_compress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/dictionary_loader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzz/block_round_trip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ZSTD_hash8', 'ZSTD_execSequenceEnd', 'ZSTD_compressContinue_internal', 'ZSTD_minGain', 'BIT_reloadDStream_internal', 'ZSTD_isAligned', 'ZSTD_safecopyLiterals', 'ZSTD_buildSequencesStatistics', 'ZSTD_entropyCompressSeqStore_wExtLitBuffer', 'ZSTD_window_update']