High level conclusions

Fuzzers reach 68.36% code coverage.

Fuzzers reach 11.96% of cyclomatic complexity.

Fuzzers reach 52.04% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

102 / 196

Cyclomatic complexity statically reachable by fuzzers

937 / 7832

Runtime code coverage of functions

134 / 196

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: zxc_fuzzer_pstream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	23.4%
gold	[1:9]	2	1.73%
yellow	[10:29]	2	1.73%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	84	73.0%
All colors	115	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	36	zxc_compress_block	call site: 00036	zxc_cctx_init
3	49	LLVMFuzzerTestOneInput	call site: 00049	cs_stage_file_header
3	103	zxc_dstream_decompress	call site: 00103	zxc_dstream_free
2	14	zxc_cctx_init_in_workspace	call site: 00014	zxc_free_cctx
2	18	zxc_cctx_free	call site: 00018	zxc_free_cctx
2	24	LLVMFuzzerTestOneInput	call site: 00024	zxc_cstream_free
2	46	zxc_cstream_compress	call site: 00046	zxc_cstream_free
2	92	ds_handle_need_block_header	call site: 00092	realloc
1	9	zxc_cctx_init	call site: 00009	zxc_dctx_entropy_sizes
1	21	LLVMFuzzerTestOneInput	call site: 00021	zxc_cstream_free
1	31	zxc_cstream_compress	call site: 00031	cs_compress_block_from
1	42	zxc_compress_block	call site: 00042	cs_set_error

Runtime coverage analysis

Covered functions

90

Functions that are reachable but not covered

7

Reachable functions

52

Percentage of reachable functions covered

86.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_pstream.c	3
src/lib/zxc_pstream.c	21
src/lib/zxc_internal.h	1
src/lib/zxc_dispatch.c	8
src/lib/zxc_common.c	14

Fuzzer: zxc_fuzzer_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	32.5%
gold	[1:9]	1	2.5%
yellow	[10:29]	2	5.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	60.0%
All colors	40	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	19	zxc_decompress_frame	call site: 00019	zxc_huf_dict_tree_build
2	16	zxc_cctx_free	call site: 00016	zxc_dict_id
2	29	zxc_decompress_frame	call site: 00029	zxc_decompress_chunk_wrapper
1	7	zxc_cctx_init	call site: 00007	zxc_dctx_entropy_sizes
1	12	zxc_cctx_init_in_workspace	call site: 00012	zxc_aligned_free
1	27	zxc_decompress_frame	call site: 00027	zxc_cctx_free
1	33	zxc_decompress_dispatch_init	call site: 00033	zxc_cctx_free

Runtime coverage analysis

Covered functions

57

Functions that are reachable but not covered

4

Reachable functions

23

Percentage of reachable functions covered

82.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_decompress.c	1
src/lib/zxc_dispatch.c	6
src/lib/zxc_common.c	10
src/lib/zxc_dict.c	1
src/lib/zxc_huffman.c	4

Fuzzer: zxc_fuzzer_seekable

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	26.0%
gold	[1:9]	3	2.43%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	88	71.5%
All colors	123	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	15	zxc_cctx_attach_dict_huf	call site: 00015	zxc_pivco_tree_build
4	22	zxc_compress	call site: 00022	zxc_compress_chunk_wrapper
4	47	zxc_seekable_free	call site: 00047	zxc_seekable_free
4	91	zxc_seek_mt_worker	call site: 00091	zxc_cctx_free
3	29	zxc_compress	call site: 00029	zxc_cctx_free
3	119	LLVMFuzzerTestOneInput	call site: 00119	zxc_seekable_decompress_range
1	7	zxc_cctx_init	call site: 00007	zxc_dctx_entropy_sizes
1	12	zxc_cctx_init_in_workspace	call site: 00012	zxc_aligned_free
1	20	zxc_cctx_free	call site: 00020	zxc_aligned_free
1	45	zxc_seekable_parse	call site: 00045	zxc_seekable_free
1	52	zxc_seekable_parse	call site: 00052	zxc_seekable_free
1	65	LLVMFuzzerTestOneInput	call site: 00065	zxc_seekable_free

Runtime coverage analysis

Covered functions

90

Functions that are reachable but not covered

16

Reachable functions

56

Percentage of reachable functions covered

71.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_seekable.c	1
src/lib/zxc_common.c	14
src/lib/zxc_dispatch.c	6
src/lib/zxc_internal.h	1
src/lib/zxc_dict.c	1
src/lib/zxc_huffman.c	4
src/lib/zxc_seekable.c	21

Fuzzer: zxc_fuzzer_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	30	44.1%
gold	[1:9]	2	2.94%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	52.9%
All colors	68	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	50	zxc_decompress_frame	call site: 00050	zxc_decompress_chunk_wrapper
5	15	zxc_compress	call site: 00015	zxc_huf_dict_tree_build
4	23	zxc_compress	call site: 00023	zxc_compress_chunk_wrapper
3	30	zxc_compress	call site: 00030	zxc_cctx_free
3	35	zxc_compress	call site: 00035	zxc_write_seek_table
3	44	zxc_decompress_frame	call site: 00044	zxc_dict_id
2	61	zxc_decompress_frame	call site: 00061	zxc_cctx_free
1	8	zxc_cctx_init	call site: 00008	zxc_dctx_entropy_sizes
1	13	zxc_cctx_init_in_workspace	call site: 00013	zxc_aligned_free
1	48	zxc_decompress_frame	call site: 00048	zxc_cctx_free
1	58	zxc_decompress_dispatch_init	call site: 00058	zxc_cctx_free

Runtime coverage analysis

Covered functions

107

Functions that are reachable but not covered

9

Reachable functions

36

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_roundtrip.c	1
src/lib/zxc_common.c	15
src/lib/zxc_dispatch.c	8
src/lib/zxc_internal.h	1
src/lib/zxc_dict.c	1
src/lib/zxc_huffman.c	4
src/lib/zxc_seekable.c	2

Fuzzer: zxc_fuzzer_dict

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	37	26.6%
gold	[1:9]	2	1.43%
yellow	[10:29]	3	2.15%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	97	69.7%
All colors	139	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	2	zxc_dict_load	call site: 00002	zxc_dict_id
5	90	zxc_compress	call site: 00090	zxc_huf_dict_tree_build
5	121	zxc_decompress_frame	call site: 00121	zxc_cctx_free
5	129	zxc_decompress_dispatch_init	call site: 00129	zxc_decompress_chunk_wrapper
4	100	zxc_compress	call site: 00100	zxc_compress_chunk_wrapper
3	96	zxc_compress	call site: 00096	zxc_cctx_free
3	106	zxc_compress	call site: 00106	zxc_write_seek_table
1	23	zxc_cctx_init	call site: 00023	zxc_dctx_entropy_sizes
1	28	zxc_cctx_init_in_workspace	call site: 00028	zxc_aligned_free
1	30	zxc_train_dict_huf	call site: 00030	zxc_cctx_free
1	115	zxc_decompress_frame	call site: 00115	zxc_cctx_free
1	117	zxc_decompress_frame	call site: 00117	zxc_cctx_free

Runtime coverage analysis

Covered functions

131

Functions that are reachable but not covered

9

Reachable functions

61

Percentage of reachable functions covered

85.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_dict.c	1
src/lib/zxc_dict.c	10
src/lib/zxc_common.c	15
src/lib/zxc_dispatch.c	10
src/lib/zxc_huffman.c	17
src/lib/zxc_internal.h	1
src/lib/zxc_seekable.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
zxc_decompress_chunk_wrapper_safe_default	/src/zxc/src/lib/zxc_decompress.c	5	['N/A', 'N/A', 'size_t', 'N/A', 'size_t']	10	0	1410	69	22	27	0	5851	5795
zxc_compress_chunk_wrapper_default	/src/zxc/src/lib/zxc_compress.c	5	['N/A', 'N/A', 'size_t', 'N/A', 'size_t']	5	0	1319	59	21	33	0	760	551
zxc_stream_compress	/src/zxc/src/lib/zxc_driver.c	3	['N/A', 'N/A', 'N/A']	6	0	322	57	21	45	0	374	179
zxc_decompress_block_safe	/src/zxc/src/lib/zxc_dispatch.c	6	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'N/A']	5	0	362	47	20	14	0	99	51
zxc_seekable_open_file	/src/zxc/src/lib/zxc_driver.c	1	['N/A']	4	0	152	16	8	11	0	69	38
zxc_compress_cctx	/src/zxc/src/lib/zxc_dispatch.c	6	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'N/A']	4	0	694	87	35	15	0	94	35

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

155 / 196

Cyclomatic complexity statically reachable by fuzzers

7558 / 7832

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzz_pstream.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_compress_block', 'LLVMFuzzerTestOneInput', 'zxc_dstream_decompress', 'zxc_cctx_init_in_workspace', 'zxc_cctx_free', 'zxc_cstream_compress', 'ds_handle_need_block_header', 'zxc_cctx_init']

tests/fuzz_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_decompress_frame', 'zxc_cctx_free', 'zxc_cctx_init', 'zxc_cctx_init_in_workspace', 'zxc_decompress_dispatch_init']

tests/fuzz_seekable.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_cctx_attach_dict_huf', 'zxc_compress', 'zxc_seekable_free', 'zxc_seek_mt_worker', 'LLVMFuzzerTestOneInput', 'zxc_cctx_init', 'zxc_cctx_init_in_workspace', 'zxc_cctx_free', 'zxc_seekable_parse']

tests/fuzz_roundtrip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_decompress_frame', 'zxc_compress', 'zxc_cctx_init', 'zxc_cctx_init_in_workspace']

tests/fuzz_dict.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_dict_load', 'zxc_compress', 'zxc_decompress_frame', 'zxc_decompress_dispatch_init', 'zxc_cctx_init', 'zxc_cctx_init_in_workspace', 'zxc_train_dict_huf']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/zxc/tests/fuzz_dict.c	['zxc_fuzzer_dict']	['zxc_fuzzer_dict']
/src/zxc/src/lib/zxc_common.c	['zxc_fuzzer_pstream', 'zxc_fuzzer_decompress', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']	['zxc_fuzzer_pstream', 'zxc_fuzzer_decompress', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']
/src/zxc/src/lib/zxc_pstream.c	['zxc_fuzzer_pstream']	['zxc_fuzzer_pstream']
/src/zxc/tests/fuzz_pstream.c	['zxc_fuzzer_pstream']	['zxc_fuzzer_pstream']
/src/zxc/tests/fuzz_roundtrip.c	['zxc_fuzzer_roundtrip']	['zxc_fuzzer_roundtrip']
/src/zxc/src/lib/zxc_driver.c	[]	[]
/src/zxc/src/lib/zxc_compress.c	[]	[]
/src/zxc/src/lib/zxc_decompress.c	[]	[]
/src/zxc/src/lib/zxc_dispatch.c	['zxc_fuzzer_pstream', 'zxc_fuzzer_decompress', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']	['zxc_fuzzer_pstream', 'zxc_fuzzer_decompress', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']
/src/zxc/src/lib/zxc_seekable.c	['zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']	['zxc_fuzzer_seekable']
/src/zxc/src/lib/zxc_dict.c	['zxc_fuzzer_decompress', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']	['zxc_fuzzer_dict']
/src/zxc/src/lib/zxc_huffman.c	['zxc_fuzzer_decompress', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']	['zxc_fuzzer_decompress', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']
/src/zxc/src/lib/zxc_internal.h	['zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']	['zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_dict']
/src/zxc/tests/fuzz_seekable.c	['zxc_fuzzer_seekable']	['zxc_fuzzer_seekable']
/src/zxc/tests/fuzz_decompress.c	['zxc_fuzzer_decompress']	['zxc_fuzzer_decompress']

Directories in report

Directory
/src/zxc/src/lib/
/src/zxc/tests/