High level conclusions

Fuzzers reach 82.90% code coverage.

Fuzzers reach 89.97% of cyclomatic complexity.

Fuzzers reach 77.45% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

213 / 275

Cyclomatic complexity statically reachable by fuzzers

7841 / 8715

Runtime code coverage of functions

228 / 275

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: zxc_fuzzer_decompress

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	20.2%
gold	[1:9]	1	1.44%
yellow	[10:29]	2	2.89%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	75.3%
All colors	69	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	55	zxc_dctx_carve	call site: 00055	zxc_cctx_attach_dict_huf
3	19	zxc_decompress	call site: 00019	zxc_probe_without_dst
3	61	zxc_pivco_tree_build	call site: 00061	zxc_cctx_attach_dict_huf
1	28	zxc_dctx_decode_frame	call site: 00028	zxc_dict_id
1	48	zxc_cctx_init	call site: 00048	zxc_dctx_entropy_sizes
1	53	zxc_cctx_init_in_workspace	call site: 00053	zxc_aligned_free

Runtime coverage analysis

Covered functions

95

Functions that are reachable but not covered

7

Reachable functions

45

Percentage of reachable functions covered

84.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_decompress.c	1
src/lib/zxc_dispatch.c	9
src/lib/zxc_common.c	22
src/lib/zxc_internal.h	3
src/lib/zxc_dict.c	1
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	5

Fuzzer: zxc_fuzzer_pstream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	37	25.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	3.44%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	103	71.0%
All colors	145	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	123	ds_drain_decoded	call site: 00123	zxc_check_seek_header
5	43	zxc_compress_block_resolved	call site: 00043	zxc_cctx_attach_dict_huf
3	49	zxc_pivco_tree_build	call site: 00049	zxc_cctx_attach_dict_huf
3	60	LLVMFuzzerTestOneInput	call site: 00060	cs_stage_file_header
2	15	zxc_cctx_init_in_workspace	call site: 00015	zxc_free_cctx
2	25	LLVMFuzzerTestOneInput	call site: 00025	zxc_cstream_free
2	40	zxc_compress_block_at	call site: 00040	zxc_cctx_init
2	57	zxc_cstream_compress	call site: 00057	zxc_cstream_free
2	116	ds_handle_need_block_header	call site: 00116	realloc
2	134	zxc_dstream_decompress	call site: 00134	zxc_dstream_free
1	10	zxc_cctx_init	call site: 00010	zxc_dctx_entropy_sizes
1	20	zxc_cctx_free	call site: 00020	zxc_free_cctx

Runtime coverage analysis

Covered functions

138

Functions that are reachable but not covered

11

Reachable functions

68

Percentage of reachable functions covered

83.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_pstream.c	3
src/lib/zxc_pstream.c	23
src/lib/zxc_internal.h	2
src/lib/zxc_dispatch.c	9
src/lib/zxc_common.c	19
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	5

Fuzzer: zxc_fuzzer_seekable

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	17.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	129	82.1%
All colors	157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	23	zxc_compress	call site: 00023	zxc_huf_dict_tree_build
4	5	zxc_compress	call site: 00005	zxc_write_empty_frame
4	32	zxc_compress	call site: 00032	zxc_cctx_free
3	126	zxc_seek_mt_worker	call site: 00126	zxc_cctx_free
3	153	LLVMFuzzerTestOneInput	call site: 00153	zxc_seekable_decompress_range
1	10	zxc_seek_table_header	call site: 00010	zxc_write_file_footer
1	16	zxc_cctx_init	call site: 00016	zxc_dctx_entropy_sizes
1	21	zxc_cctx_init_in_workspace	call site: 00021	zxc_aligned_free
1	30	zxc_cctx_free	call site: 00030	zxc_aligned_free
1	37	zxc_compress	call site: 00037	zxc_cctx_free
1	79	zxc_seek_load_spans	call site: 00079	zxc_seek_source_read
1	92	LLVMFuzzerTestOneInput	call site: 00092	zxc_seekable_free

Runtime coverage analysis

Covered functions

135

Functions that are reachable but not covered

21

Reachable functions

74

Percentage of reachable functions covered

71.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_seekable.c	1
src/lib/zxc_common.c	25
src/lib/zxc_dispatch.c	4
src/lib/zxc_internal.h	3
src/lib/zxc_dict.c	1
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	5
src/lib/zxc_seekable.c	21

Fuzzer: zxc_fuzzer_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	50	50.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	50	50.0%
All colors	100	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	48	LLVMFuzzerTestOneInput	call site: 00048	zxc_probe_without_dst
6	6	zxc_compress	call site: 00006	zxc_write_empty_frame
4	33	zxc_compress	call site: 00033	zxc_cctx_free
4	41	zxc_compress	call site: 00041	zxc_write_seek_table
4	88	zxc_dctx_carve	call site: 00088	zxc_cctx_attach_dict_huf
3	24	zxc_compress	call site: 00024	zxc_huf_dict_tree_build
3	78	zxc_check_eof_header	call site: 00078	zxc_check_seek_header
2	28	zxc_pivco_tree_build	call site: 00028	zxc_cctx_free
1	17	zxc_cctx_init	call site: 00017	zxc_dctx_entropy_sizes
1	22	zxc_cctx_init_in_workspace	call site: 00022	zxc_aligned_free
1	38	zxc_compress	call site: 00038	zxc_cctx_free
1	73	zxc_dctx_decode_frame	call site: 00073	zxc_dict_id

Runtime coverage analysis

Covered functions

150

Functions that are reachable but not covered

20

Reachable functions

57

Percentage of reachable functions covered

64.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_roundtrip.c	1
src/lib/zxc_common.c	29
src/lib/zxc_dispatch.c	11
src/lib/zxc_internal.h	4
src/lib/zxc_dict.c	1
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	5

Fuzzer: zxc_fuzzer_block

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	37	22.0%
gold	[1:9]	3	1.78%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	128	76.1%
All colors	168	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	58	zxc_decompress_chunk_wrapper_safe_default	call site: 00058	zxc_decode_block_glo_entropy_safe
8	101	zxc_decompress_block	call site: 00101	zxc_cctx_attach_dict_huf
4	47	zxc_decode_block_glo_entropy	call site: 00047	zxc_decode_lit_pivco
3	32	zxc_decode_block_glo_entropy_safe	call site: 00032	zxc_huf_decode_section_dict_default
2	14	zxc_decode_block_glo_entropy_safe	call site: 00014	zxc_decode_block_glo_entropy_safe
2	40	zxc_decode_block_glo_entropy	call site: 00040	zxc_decode_block_glo_entropy_dict
2	79	zxc_decompress_chunk_wrapper_safe_default	call site: 00079	zxc_decode_copy_match_exact
2	84	zxc_decode_block_ghi	call site: 00084	zxc_decode_bounce
2	87	zxc_decode_bounce	call site: 00087	zxc_decompress_block
2	142	zxc_compress_block_at	call site: 00142	zxc_cctx_init
1	99	zxc_cctx_init_in_workspace	call site: 00099	zxc_aligned_free
1	145	zxc_compress_block_resolved	call site: 00145	zxc_compress_chunk_wrapper

Runtime coverage analysis

Covered functions

160

Functions that are reachable but not covered

11

Reachable functions

69

Percentage of reachable functions covered

84.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_block.c	4
src/lib/zxc_common.c	13
src/lib/zxc_dispatch.c	20
src/lib/zxc_decompress.c	15
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	9
src/lib/zxc_internal.h	1

Fuzzer: zxc_fuzzer_stream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	44	20.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	172	79.6%
All colors	216	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	118	zxc_async_writer	call site: 00118	pthread_mutex_lock
4	30	zxc_stream_read_exact	call site: 00030	zxc_stream_read_at
4	88	zxc_cctx_free	call site: 00088	pthread_mutex_lock
3	13	zxc_scan_container	call site: 00013	zxc_short_input_verdict
3	80	zxc_stream_worker	call site: 00080	zxc_huf_dict_tree_build
3	125	zxc_async_writer	call site: 00125	pthread_mutex_lock
3	148	zxc_stream_read_blocks	call site: 00148	zxc_stream_reader_fail
2	61	zxc_stream_regular_fd	call site: 00061	zxc_stream_open_positioned
2	84	zxc_pivco_tree_build	call site: 00084	zxc_cctx_free
2	106	zxc_stream_worker	call site: 00106	pthread_cond_broadcast
2	171	zxc_check_file_footer	call site: 00171	pthread_mutex_lock
1	8	zxc_file_span	call site: 00008	fseeko64

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

35

Reachable functions

96

Percentage of reachable functions covered

63.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_stream.c	3
src/lib/zxc_common.c	26
src/lib/zxc_driver.c	25
src/lib/zxc_internal.h	3
src/lib/zxc_dict.c	1
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	5
src/lib/zxc_dispatch.c	2

Fuzzer: zxc_fuzzer_inplace

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	18.8%
gold	[1:9]	3	2.09%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	113	79.0%
All colors	143	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	65	zxc_dctx_carve	call site: 00065	zxc_cctx_attach_dict_huf
5	91	zxc_compress	call site: 00091	zxc_write_empty_frame
4	101	zxc_compress	call site: 00101	zxc_cctx_free
3	71	zxc_pivco_tree_build	call site: 00071	zxc_cctx_attach_dict_huf
2	22	zxc_scan_whole_frame	call site: 00022	zxc_short_input_verdict
2	124	zxc_compress_block_at	call site: 00124	zxc_cctx_init
1	40	zxc_dctx_decode_frame	call site: 00040	zxc_dict_id
1	55	zxc_dctx_decode_frame	call site: 00055	zxc_cctx_free
1	63	zxc_cctx_init	call site: 00063	zxc_aligned_free
1	99	zxc_compress	call site: 00099	zxc_cctx_free
1	106	zxc_compress	call site: 00106	zxc_cctx_free
1	127	zxc_compress_block_resolved	call site: 00127	zxc_compress_chunk_wrapper

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

9

Reachable functions

76

Percentage of reachable functions covered

88.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_inplace.c	5
src/lib/zxc_dispatch.c	25
src/lib/zxc_common.c	29
src/lib/zxc_internal.h	3
src/lib/zxc_dict.c	1
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	5

Fuzzer: zxc_fuzzer_dict

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	66	30.2%
gold	[1:9]	5	2.29%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	147	67.4%
All colors	218	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	53	zxc_compress	call site: 00053	zxc_decompress
9	2	zxc_dict_load	call site: 00002	dict_huf_roundtrip
6	13	zxc_compress	call site: 00013	zxc_write_empty_frame
4	48	zxc_compress	call site: 00048	zxc_write_seek_table
3	40	zxc_compress	call site: 00040	zxc_cctx_free
3	85	zxc_check_eof_header	call site: 00085	zxc_check_seek_header
3	194	zxc_compress_cctx_resolved	call site: 00194	zxc_write_seek_table_from_blocks
2	44	zxc_compress	call site: 00044	zxc_cctx_free
2	99	zxc_dctx_decode_frame	call site: 00099	zxc_decompress_chunk_wrapper
2	103	zxc_decompress	call site: 00103	memcmp
2	186	zxc_compress_cctx_resolved	call site: 00186	zxc_write_empty_frame
2	211	zxc_decompress_dctx	call site: 00211	zxc_probe_without_dst

Runtime coverage analysis

Covered functions

184

Functions that are reachable but not covered

22

Reachable functions

92

Percentage of reachable functions covered

76.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz_dict.c	2
src/lib/zxc_dict.c	10
src/lib/zxc_common.c	29
src/lib/zxc_dispatch.c	22
src/lib/zxc_internal.h	4
src/lib/zxc_deps.h	2
src/lib/zxc_huffman.c	18

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
zxc_compress_chunk_wrapper_default	/src/zxc/src/lib/zxc_compress.c	6	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'size_t']	5	0	1311	58	21	38	0	846	637

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

234 / 275

Cyclomatic complexity statically reachable by fuzzers

8478 / 8715

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzz_decompress.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_dctx_carve', 'zxc_decompress', 'zxc_pivco_tree_build', 'zxc_dctx_decode_frame', 'zxc_cctx_init', 'zxc_cctx_init_in_workspace']

tests/fuzz_pstream.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ds_drain_decoded', 'zxc_compress_block_resolved', 'zxc_pivco_tree_build', 'LLVMFuzzerTestOneInput', 'zxc_cctx_init_in_workspace', 'zxc_compress_block_at', 'zxc_cstream_compress', 'ds_handle_need_block_header', 'zxc_dstream_decompress']

tests/fuzz_seekable.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_compress', 'zxc_seek_mt_worker', 'LLVMFuzzerTestOneInput', 'zxc_seek_table_header', 'zxc_cctx_init', 'zxc_cctx_init_in_workspace', 'zxc_cctx_free']

tests/fuzz_roundtrip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'zxc_compress', 'zxc_dctx_carve', 'zxc_check_eof_header', 'zxc_pivco_tree_build', 'zxc_cctx_init', 'zxc_cctx_init_in_workspace']

tests/fuzz_block.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_decompress_chunk_wrapper_safe_default', 'zxc_decompress_block', 'zxc_decode_block_glo_entropy', 'zxc_decode_block_glo_entropy_safe', 'zxc_decode_block_ghi', 'zxc_decode_bounce', 'zxc_compress_block_at']

tests/fuzz_stream.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_async_writer', 'zxc_stream_read_exact', 'zxc_cctx_free', 'zxc_scan_container', 'zxc_stream_worker', 'zxc_stream_read_blocks', 'zxc_stream_regular_fd', 'zxc_pivco_tree_build']

tests/fuzz_inplace.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_dctx_carve', 'zxc_compress', 'zxc_pivco_tree_build', 'zxc_scan_whole_frame', 'zxc_compress_block_at', 'zxc_dctx_decode_frame', 'zxc_cctx_init']

tests/fuzz_dict.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['zxc_compress', 'zxc_dict_load', 'zxc_check_eof_header', 'zxc_compress_cctx_resolved', 'zxc_dctx_decode_frame', 'zxc_decompress']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/zxc/src/lib/zxc_huffman.c	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']
/src/zxc/tests/fuzz_decompress.c	['zxc_fuzzer_decompress']	['zxc_fuzzer_decompress']
/src/zxc/src/lib/zxc_pstream.c	['zxc_fuzzer_pstream']	['zxc_fuzzer_pstream']
/src/zxc/src/lib/zxc_deps.h	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']
/src/zxc/tests/fuzz_stream.c	['zxc_fuzzer_stream']	['zxc_fuzzer_stream']
/src/zxc/tests/fuzz_dict.c	['zxc_fuzzer_dict']	['zxc_fuzzer_dict']
/src/zxc/src/lib/zxc_dispatch.c	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']
/src/zxc/tests/fuzz_inplace.c	['zxc_fuzzer_inplace']	['zxc_fuzzer_inplace']
/src/zxc/src/lib/zxc_dict.c	['zxc_fuzzer_decompress', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']	['zxc_fuzzer_stream', 'zxc_fuzzer_dict']
/src/zxc/src/lib/zxc_driver.c	['zxc_fuzzer_stream']	['zxc_fuzzer_stream']
/src/zxc/tests/fuzz_block.c	['zxc_fuzzer_block']	['zxc_fuzzer_block']
/src/zxc/src/lib/zxc_common.c	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']
/src/zxc/tests/fuzz_roundtrip.c	['zxc_fuzzer_roundtrip']	['zxc_fuzzer_roundtrip']
/src/zxc/src/lib/zxc_compress.c	[]	[]
/src/zxc/src/lib/zxc_seekable.c	['zxc_fuzzer_seekable']	['zxc_fuzzer_seekable']
/src/zxc/src/lib/zxc_decompress.c	['zxc_fuzzer_block']	['zxc_fuzzer_block']
/src/zxc/tests/fuzz_pstream.c	['zxc_fuzzer_pstream']	['zxc_fuzzer_pstream']
/src/zxc/src/lib/zxc_internal.h	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']	['zxc_fuzzer_decompress', 'zxc_fuzzer_pstream', 'zxc_fuzzer_seekable', 'zxc_fuzzer_roundtrip', 'zxc_fuzzer_block', 'zxc_fuzzer_stream', 'zxc_fuzzer_inplace', 'zxc_fuzzer_dict']
/src/zxc/tests/fuzz_seekable.c	['zxc_fuzzer_seekable']	['zxc_fuzzer_seekable']

Directories in report

Directory
/src/zxc/tests/
/src/zxc/src/lib/