High level conclusions

Fuzzer glib/fuzzing/fuzz_resolver.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_resolver.c covers 23.76% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_uri_parse.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_uri_parse.c covers 25.06% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_bookmark.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_bookmark.c covers 27.77% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_dbus_message.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_dbus_message.c covers 22.63% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_date_parse.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_date_parse.c covers 26.84% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_binary.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_binary.c covers 22.13% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_text.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_text.c covers 20.03% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_date_time_new_from_iso8601.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_date_time_new_from_iso8601.c covers 19.47% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_binary_byteswap.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_binary_byteswap.c covers 22.04% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 9.860% of cyclomatic complexity.

Fuzzers reach 7.600% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1267 / 16669

Cyclomatic complexity statically reachable by fuzzers

11530 / 116927

Runtime code coverage of functions

619 / 16669

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: glib/fuzzing/fuzz_key.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	175	71.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	71	28.8%
All colors	246	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
5	240	g_logv	call site: 00240	test_parse
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

244

Reachable functions

404

Percentage of reachable functions covered

39.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_key.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: glib/fuzzing/fuzz_variant_binary_byteswap.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	846	88.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	106	11.1%
All colors	952	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	348	fast_validate_len	call site: 00348	g_variant_deep_copy
262	629	g_string_new	call site: 00629	g_variant_deep_copy
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
58	893	g_utf8_validate	call site: 00893	g_variant_get_normal_form
54	240	g_logv	call site: 00240	g_variant_new_from_data
37	296	g_memdup2	call site: 00296	g_variant_byteswap
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

389

Reachable functions

499

Percentage of reachable functions covered

22.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_binary_byteswap.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant.c	27
glib/glib/gvarianttype.c	26
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	23
glib/glib/gvarianttypeinfo.c	4
glib/glib/gvariant-serialiser.c	10
glib/glib/gbitlock.c	5
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1

Fuzzer: glib/fuzzing/fuzz_uuid_string_is_valid.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	71.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	73	28.6%
All colors	255	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
9	245	g_strndup	call site: 00245	g_uuid_string_is_valid
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
3	240	g_logv	call site: 00240	g_mutex_unlock
2	10	g_logv	call site: 00010

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

204

Reachable functions

295

Percentage of reachable functions covered

30.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uuid_string_is_valid.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/guuid.c	2

Fuzzer: glib/fuzzing/fuzz_network_address_parse_uri.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1024	65.0%
gold	[1:9]	88	5.59%
yellow	[10:29]	17	1.08%
greenyellow	[30:49]	50	3.17%
lawngreen	50+	394	25.0%
All colors	1573	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
206	598	g_quark_from_string	call site: 00598	g_object_new
78	1384	g_param_value_validate	call site: 01384	g_strdup_value_contents
72	1044	type_data_unref_U	call site: 01044	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
46	272	g_string_sized_new	call site: 00272	parse_userinfo
38	349	g_utf8_validate	call site: 00349	parse_host
30	207	g_error_allocate	call site: 00207	g_warning
27	472	g_string_new	call site: 00472	g_utf8_strdown
26	571	g_quark_to_string	call site: 00571	g_quark_from_string
25	443	g_error_free	call site: 00443	g_hostname_to_ascii
25	830	g_type_class_ref	call site: 00830	type_data_ref_Wm
21	965	type_iface_peek_holder_L	call site: 00965	type_data_ref_Wm

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

406

Reachable functions

592

Percentage of reachable functions covered

31.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_network_address_parse_uri.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	10
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	23
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gnetworkaddress.c	1
glib/glib/guri.c	13
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1
glib/glib/ghostutils.c	13
glib/glib/guniprop.c	8
glib/glib/gwin32.c	1
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/gunidecomp.c	8
glib/gobject/gobject.c	20
glib/gobject/gtype.c	41
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_utf8_validate.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	173	66.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	33.2%
All colors	259	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
3	240	g_logv	call site: 00240	g_utf8_validate_len
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

199

Reachable functions

290

Percentage of reachable functions covered

31.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_utf8_validate.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	7
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: glib/fuzzing/fuzz_inet_address_mask_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	840	58.0%
gold	[1:9]	96	6.62%
yellow	[10:29]	17	1.17%
greenyellow	[30:49]	50	3.45%
lawngreen	50+	445	30.7%
All colors	1448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	538	type_data_unref_U	call site: 00538	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	1020	g_param_value_validate	call site: 01020	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
26	790	g_quark_to_string	call site: 00790	g_quark_from_string
26	1323	g_signal_handlers_destroy	call site: 01323	remove_invalid_closure_notify
25	322	g_type_class_ref	call site: 00322	type_data_ref_Wm
21	457	type_iface_peek_holder_L	call site: 00457	type_data_ref_Wm
20	1426	g_type_free_instance	call site: 01426	g_object_unref
19	1217	g_object_new_valist	call site: 01217	g_inet_address_mask_new
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	354	check_type_info_I	call site: 00354	type_data_make_W

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

378

Reachable functions

567

Percentage of reachable functions covered

33.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_address_mask_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	26
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetaddressmask.c	3
glib/gio/ginetaddress.c	4
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	22
glib/gobject/gtype.c	42
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	9
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gio/ginitable.c	3
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6

Fuzzer: glib/fuzzing/fuzz_date_time_new_from_iso8601.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1664	82.4%
gold	[1:9]	36	1.78%
yellow	[10:29]	14	0.69%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	305	15.1%
All colors	2019	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
387	1169	g_string_maybe_expand	call site: 01169	init_zone_from_iana_info
237	1567	g_hash_table_remove_internal	call site: 01567	g_time_zone_new_identifier
205	1813	g_string_append_printf	call site: 01813	g_date_time_format
87	583	try_conversion	call site: 00583	_g_charset_get_aliases
83	1084	get_contents_posix	call site: 01084	zone_identifier_illumos
71	888	g_build_path_va	call site: 00888	g_lstat
70	800	g_string_sized_new	call site: 00800	g_win32_readlink_utf8
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
45	703	g_convert_with_iconv	call site: 00703	g_realloc
31	749	g_get_console_charset	call site: 00749	g_locale_to_utf8
30	207	g_error_allocate	call site: 00207	g_warning
26	441	g_quark_to_string	call site: 00441	g_quark_from_string

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

488

Reachable functions

606

Percentage of reachable functions covered

19.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_date_time_new_from_iso8601.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	18
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	11
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	13
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	10
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	8
glib/glib/tests/messages-low-memory.c	1
glib/glib/gdatetime.c	37
glib/glib/gtimezone.c	47
glib/glib/gfileutils.c	17
glib/glib/gconvert.c	16
glib/glib/gthread.c	1
glib/glib/gmem.h	1
glib/glib/gcharset.c	7
glib/glib/libcharset/localcharset.c	3
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/garray.c	11
glib/glib/gutilsprivate.h	1
glib/glib/win_iconv.c	12
glib/glib/gwin32.c	2
glib/glib/gstring.c	8
glib/glib/gstdio.c	15
glib/glib/gstdio-private.c	2
glib/glib/ggettext.c	2
glib/.gitlab-ci/coverity-model.c	1
glib/glib/guniprop.c	11
glib/glib/gdate.c	17
glib/glib/gmappedfile.c	7
glib/glib/gbytes.c	3
glib/glib/gunidecomp.c	4

Fuzzer: glib/fuzzing/fuzz_inet_socket_address_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	872	59.6%
gold	[1:9]	96	6.56%
yellow	[10:29]	17	1.16%
greenyellow	[30:49]	50	3.41%
lawngreen	50+	428	29.2%
All colors	1463	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
84	1377	g_type_free_instance	call site: 01377	g_unix_socket_address_new_with_type
72	499	type_data_unref_U	call site: 00499	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	981	g_param_value_validate	call site: 00981	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
26	751	g_quark_to_string	call site: 00751	g_quark_from_string
26	1270	g_signal_handlers_destroy	call site: 01270	remove_invalid_closure_notify
25	283	g_type_class_ref	call site: 00283	type_data_ref_Wm
21	418	type_iface_peek_holder_L	call site: 00418	type_data_ref_Wm
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	315	check_type_info_I	call site: 00315	type_data_make_W
16	1065	g_string_append_printf	call site: 01065	g_critical

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

393

Reachable functions

583

Percentage of reachable functions covered

32.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_socket_address_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	26
glib/glib/gslice.c	2
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetsocketaddress.c	2
glib/gio/gsocketaddress.c	1
glib/gio/ginetaddress.c	3
glib/gobject/gobject.c	22
glib/gobject/gtype.c	42
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	9
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6
glib/gio/gunixsocketaddress.c	3
glib/glib/garray.c	7
glib/gio/gnativesocketaddress.c	1
glib/gio/gnetworking.c	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_variant_text.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1321	91.4%
gold	[1:9]	2	0.13%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	122	8.44%
All colors	1445	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
397	712	g_utf8_validate	call site: 00712	maybe_parse
330	1114	get_C_locale	call site: 01114	g_variant_print
181	370	g_strndup	call site: 00370	g_variant_new_va
142	553	g_memdup2	call site: 00553	g_variant_new_array
87	281	g_string_append_printf	call site: 00281	array_parse
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
10	240	g_logv	call site: 00240	g_variant_parse
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

467

Reachable functions

584

Percentage of reachable functions covered

20.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_text.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	11
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	10
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant-parser.c	37
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gvariant.c	45
glib/glib/gvarianttype.c	29
glib/glib/gvariant-core.c	19
glib/glib/gvarianttypeinfo.c	4
glib/glib/gbytes.c	7
glib/glib/gbitlock.c	5
glib/glib/gvariant-serialiser.c	8
glib/glib/gmem.h	1
glib/glib/guniprop.c	1

Fuzzer: glib/fuzzing/fuzz_variant_binary.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	814	88.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	106	11.5%
All colors	920	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
275	588	g_string_new	call site: 00588	g_variant_deep_copy
216	353	fast_validate_len	call site: 00353	g_variant_deep_copy
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
54	240	g_logv	call site: 00240	g_variant_new_from_data
54	865	g_utf8_validate	call site: 00865	g_variant_get_string
42	296	g_memdup2	call site: 00296	g_variant_get_normal_form
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

387

Reachable functions

497

Percentage of reachable functions covered

22.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_binary.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant.c	26
glib/glib/gvarianttype.c	26
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	22
glib/glib/gvarianttypeinfo.c	4
glib/glib/gvariant-serialiser.c	9
glib/glib/gbitlock.c	5
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1

Fuzzer: glib/fuzzing/fuzz_inet_address_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	682	57.0%
gold	[1:9]	88	7.36%
yellow	[10:29]	17	1.42%
greenyellow	[30:49]	50	4.18%
lawngreen	50+	358	29.9%
All colors	1195	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	500	type_data_unref_U	call site: 00500	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	982	g_param_value_validate	call site: 00982	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
26	752	g_quark_to_string	call site: 00752	g_quark_from_string
25	284	g_type_class_ref	call site: 00284	type_data_ref_Wm
21	419	type_iface_peek_holder_L	call site: 00419	type_data_ref_Wm
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	316	check_type_info_I	call site: 00316	type_data_make_W
16	1066	g_string_append_printf	call site: 01066	g_critical
15	659	g_utf8_validate	call site: 00659	g_quark_from_static_string
13	153	g_logv	call site: 00153	g_utf8_to_utf16

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

331

Reachable functions

515

Percentage of reachable functions covered

35.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_address_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	23
glib/glib/gslice.c	2
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetaddress.c	3
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	20
glib/gobject/gtype.c	41
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1

Fuzzer: fuzz-repo.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3250	69.7%
gold	[1:9]	178	3.81%
yellow	[10:29]	21	0.45%
greenyellow	[30:49]	50	1.07%
lawngreen	50+	1163	24.9%
All colors	4662	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
435	1467	ptr_array_maybe_null_terminate	call site: 01467	create_file_metadata
355	791	g_string_append_printf	call site: 00791	g_variant_lookup
164	3611	reload_core_config	call site: 03611	g_file_new_for_path
156	4380	reload_remote_config	call site: 04380	g_file_new_for_path
124	4039	g_type_ensure	call site: 04039	try_implementation
112	3925	g_type_free_instance	call site: 03925	g_io_modules_scan_all_in_directory_with_scope
106	1148	g_strfreev	call site: 01148	g_variant_valist_get
87	583	try_conversion	call site: 00583	_g_charset_get_aliases
78	2468	g_param_value_validate	call site: 02468	g_strdup_value_contents
72	2135	type_data_unref_U	call site: 02135	type_data_last_unref_Wm
60	27	g_vasprintf	call site: 00027	g_pattern_match_simple
52	3384	regex_compile	call site: 03384	get_pcre2_error_string

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

922

Reachable functions

1320

Percentage of reachable functions covered

30.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz-repo.c	2
ostreelibostree/ostree-repo.c	24
glib/glib/gfileutils.c	15
glib/glib/gstring.c	9
glib/glib/gmessages.h	4
glib/glib/gmessages.c	18
glib/glib/gstrfuncs.c	22
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	16
glib/glib/gslist.c	11
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	14
glib/glib/ghash.c	32
glib/glib/gslice.c	3
glib/glib/gmem.c	9
glib/glib/tests/messages-low-memory.c	1
glib/glib/gutilsprivate.h	1
ostree/libglnx/glnx-fdio.h	4
ostree/libglnx/glnx-errors.c	5
glib/gio/gioerror.c	2
glib/glib/gcharset.c	12
glib/glib/gthread.c	1
glib/glib/gmem.h	1
glib/glib/genviron.c	1
glib/glib/gquark.c	9
glib/glib/glib-private.h	1
glib/glib/gwin32.c	3
glib/glib/libcharset/localcharset.c	3
glib/glib/gconvert.c	15
glib/glib/win_iconv.c	12
ostree/libglnx/glnx-dirfd.c	3
ostree/libglnx/glnx-dirfd.h	1
glib/glib/gmain.h	1
glib/glib/gvariant.c	65
glib/glib/gvariant-core.c	19
glib/glib/gbitlock.c	5
glib/glib/gvariant-serialiser.c	8
glib/glib/gvarianttypeinfo.c	4
glib/glib/gbytes.c	7
glib/glib/gvarianttype.c	27
ostree/libglnx/glnx-fdio.c	12
glib/glib/grand.c	11
glib/glib/gmain.c	2
ostree/libglnx/glnx-missing-syscall.h	1
ostreelibostree/ostree-repo-commit.c	2
ostreelibostree/ostree-core.c	2
glib/glib/garray.c	11
glib/glib/gqsort.c	3
glib/gobject/gobject.c	28
glib/gobject/gtype.c	43
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	10
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstdio.c	3
glib/glib/ggettext.c	2
ostreelibotutil/ot-gio-utils.h	1
ostreelibotutil/ot-gio-utils.c	1
glib/gio/gfile.c	6
ostree/libglnx/glnx-shutil.c	2
glib/gio/gcancellable.c	4
glib/glib/gkeyfile.c	46
glib/glib/glist.c	10
glib/.gitlab-ci/coverity-model.c	1
glib/glib/guniprop.c	3
ostreelibotutil/ot-keyfile-utils.c	9
glib/glib/gregex.c	25
ostreelibostree/ostree-repo-verity.c	1
ostreelibostree/ostree-repo-composefs.c	1
glib/gio/gvfs.c	3
glib/gio/glocalvfs.c	1
glib/gio/giomodule.c	17
glib/gmodule/gmodule.c	1
glib/glib/gdir.c	4
glib/gobject/gtypemodule.c	2
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6
glib/gio/ginitable.c	3
ostreelibostree/ostree-remote.c	5
glib/glib/gqueue.c	3
ostreelibostree/ostree-sysroot.c	1
glib/gio/gfileenumerator.c	3
glib/gio/gfileinfo.c	10
glib/gio/gfileattribute.c	2

Fuzzer: glib/fuzzing/fuzz_uri_escape.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	174	71.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	71	28.9%
All colors	245	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
4	240	g_logv	call site: 00240	test_bytes
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

226

Reachable functions

327

Percentage of reachable functions covered

30.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_escape.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: glib/fuzzing/fuzz_date_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	890	78.2%
gold	[1:9]	29	2.55%
yellow	[10:29]	14	1.23%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	204	17.9%
All colors	1137	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	360	g_realloc	call site: 00360	g_date_get_sunday_week_of_year
106	1030	g_string_maybe_expand	call site: 01030	g_date_strftime
73	775	try_conversion	call site: 00775	_g_charset_get_aliases
60	20	g_vasprintf	call site: 00020	g_pattern_match_simple
58	270	fast_validate_len	call site: 00270	g_date_prepare_to_parse
45	911	g_convert_with_iconv	call site: 00911	g_realloc
30	209	g_error_allocate	call site: 00209	g_warning
27	983	g_iconv_close	call site: 00983	g_utf8_casefold
23	599	_g_locale_charset_raw	call site: 00599
21	330	g_utf8_validate	call site: 00330	win32_strftime_helper
19	957	g_get_console_charset	call site: 00957	g_locale_to_utf8
17	101	g_strdup_printf	call site: 00101	g_log_default_handler

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

267

Reachable functions

365

Percentage of reachable functions covered

26.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_date_parse.c	1
glib/glib/gdate.c	25
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	18
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	6
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	15
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	21
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/garray.c	6
glib/glib/gutilsprivate.h	1
glib/glib/gconvert.c	13
glib/glib/gcharset.c	5
glib/glib/gthread.c	1
glib/glib/gmem.h	1
glib/glib/libcharset/localcharset.c	3
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/win_iconv.c	12
glib/glib/gwin32.c	1
glib/glib/guniprop.c	2
glib/glib/gstring.c	6
glib/glib/gunidecomp.c	7

Fuzzer: fuzz-bsdiff.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	654	55.2%
gold	[1:9]	88	7.43%
yellow	[10:29]	17	1.43%
greenyellow	[30:49]	50	4.22%
lawngreen	50+	375	31.6%
All colors	1184	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	483	type_data_unref_U	call site: 00483	type_data_last_unref_Wm
60	28	g_vasprintf	call site: 00028	g_pattern_match_simple
60	965	g_param_value_validate	call site: 00965	g_strdup_value_contents
30	220	g_error_allocate	call site: 00220	g_warning
26	735	g_quark_to_string	call site: 00735	g_quark_from_string
25	267	g_type_class_ref	call site: 00267	type_data_ref_Wm
21	402	type_iface_peek_holder_L	call site: 00402	type_data_ref_Wm
17	109	g_strdup_printf	call site: 00109	g_log_default_handler
16	299	check_type_info_I	call site: 00299	type_data_make_W
16	1049	g_string_append_printf	call site: 01049	g_critical
15	642	g_utf8_validate	call site: 00642	g_quark_from_static_string
13	163	g_logv	call site: 00163	g_utf8_to_utf16

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

317

Reachable functions

510

Percentage of reachable functions covered

37.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz-bsdiff.c	1
glib/gio/gmemoryoutputstream.c	2
glib/gobject/gobject.c	19
glib/gobject/gtype.c	41
glib/glib/gmessages.h	3
glib/glib/gmessages.c	16
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	23
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
ostree/bsdiff/bsdiff.c	8

Fuzzer: glib/fuzzing/fuzz_network_address_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	706	56.9%
gold	[1:9]	88	7.10%
yellow	[10:29]	17	1.37%
greenyellow	[30:49]	50	4.03%
lawngreen	50+	378	30.5%
All colors	1239	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	546	type_data_unref_U	call site: 00546	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	1028	g_param_value_validate	call site: 01028	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
26	798	g_quark_to_string	call site: 00798	g_quark_from_string
25	330	g_type_class_ref	call site: 00330	type_data_ref_Wm
23	281	g_error_free	call site: 00281	g_network_address_new
21	465	type_iface_peek_holder_L	call site: 00465	type_data_ref_Wm
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	362	check_type_info_I	call site: 00362	type_data_make_W
16	1112	g_string_append_printf	call site: 01112	g_critical
15	705	g_utf8_validate	call site: 00705	g_quark_from_static_string

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

331

Reachable functions

515

Percentage of reachable functions covered

35.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_network_address_parse.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	23
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gnetworkaddress.c	2
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	20
glib/gobject/gtype.c	41
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_dbus_message.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2603	80.2%
gold	[1:9]	105	3.23%
yellow	[10:29]	17	0.52%
greenyellow	[30:49]	50	1.54%
lawngreen	50+	467	14.4%
All colors	3242	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
897	1425	_g_dgettext_should_translate	call site: 01425	parse_value_from_blob
362	2700	g_clear_object	call site: 02700	g_dbus_message_to_blob
122	2577	g_hash_table_remove_internal	call site: 02577	parse_value_from_blob
108	2458	g_strfreev	call site: 02458	g_variant_valist_get
107	1274	g_strndup	call site: 01274	g_variant_new_boolean
90	2366	g_propagate_error	call site: 02366	g_variant_get
72	531	type_data_unref_U	call site: 00531	type_data_last_unref_Wm
62	1210	g_object_new_valist	call site: 01210	parse_value_from_blob
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	1013	g_param_value_validate	call site: 01013	g_strdup_value_contents
40	2325	get_C_locale	call site: 02325	g_variant_get_string
30	207	g_error_allocate	call site: 00207	g_warning

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

694

Reachable functions

897

Percentage of reachable functions covered

22.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_dbus_message.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	18
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	12
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	28
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gdbusmessage.c	37
glib/gobject/gobject.c	22
glib/gobject/gtype.c	42
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	9
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/gio/gdbusprivate.c	1
glib/glib/gvarianttype.c	32
glib/glib/gvariant.c	73
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	24
glib/glib/gvarianttypeinfo.c	5
glib/glib/gvariant-serialiser.c	10
glib/glib/ggettext.c	2
glib/glib/gwin32.c	1
glib/glib/gbitlock.c	5
glib/glib/gmem.h	1
glib/glib/guniprop.c	1
glib/.gitlab-ci/coverity-model.c	1
glib/gio/gdbusutils.c	6
glib/gio/gunixfdlist.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6

Fuzzer: glib/fuzzing/fuzz_canonicalize_filename.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	306	64.1%
gold	[1:9]	3	0.62%
yellow	[10:29]	14	2.93%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	154	32.2%
All colors	477	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
34	442	g_build_path_va	call site: 00442	g_build_filename
31	245	g_strndup	call site: 00245	g_canonicalize_filename
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
15	293	g_utf8_validate	call site: 00293	g_quark_from_static_string
14	388	g_quark_to_string	call site: 00388	g_quark_from_string
14	403	g_quark_from_string	call site: 00403	g_build_filename
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

215

Reachable functions

314

Percentage of reachable functions covered

31.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_canonicalize_filename.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	18
glib/glib/gslice.c	2
glib/glib/gmem.c	4
glib/glib/tests/messages-low-memory.c	1
glib/glib/gfileutils.c	7
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1

Fuzzer: glib/fuzzing/fuzz_bookmark.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	563	79.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	146	20.5%
All colors	709	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
128	570	g_error_new_valist	call site: 00570	unescape_gstring_inplace
68	384	g_utf8_get_char_validated	call site: 00384	emit_end_element
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
56	469	g_utf8_validate	call site: 00469	emit_start_element
42	263	g_hash_table_setup_storage	call site: 00263	g_bookmark_file_load_from_data
40	526	g_slist_prepend	call site: 00526	unescape_gstring_inplace
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
12	312	g_string_sized_new	call site: 00312	set_error
10	342	g_strconcat	call site: 00342	g_propagate_error
9	0	EP	call site: 00000	fuzz_set_logging_func

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

286

Reachable functions

396

Percentage of reachable functions covered

27.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_bookmark.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	10
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	8
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/gbookmarkfile.c	6
glib/glib/glist.c	3
glib/glib/gmarkup.c	36
glib/glib/gstring.c	2
glib/glib/gutilsprivate.h	1
glib/glib/guniprop.c	1

Fuzzer: glib/fuzzing/fuzz_utf8_normalize.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	223	75.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	71	24.1%
All colors	294	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
53	240	g_logv	call site: 00240	g_utf8_normalize
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

211

Reachable functions

302

Percentage of reachable functions covered

30.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_utf8_normalize.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	8
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/gunidecomp.c	7

Fuzzer: glib/fuzzing/fuzz_paths.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	222	75.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	73	24.7%
All colors	295	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
49	245	g_strndup	call site: 00245	g_path_get_basename
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
3	240	g_logv	call site: 00240	g_mutex_unlock
2	10	g_logv	call site: 00010

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

207

Reachable functions

298

Percentage of reachable functions covered

30.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_paths.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/gfileutils.c	3

Fuzzer: glib/fuzzing/fuzz_uri_parse_params.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	278	58.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	13	2.74%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	182	38.4%
All colors	473	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
23	289	g_string_sized_new	call site: 00289	g_string_append_printf
22	343	g_utf8_validate	call site: 00343	uri_decode
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
17	265	g_hash_table_setup_storage	call site: 00265	g_uri_params_iter_next
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
8	240	g_logv	call site: 00240	g_uri_parse_params
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

214

Reachable functions

319

Percentage of reachable functions covered

32.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_parse_params.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/guri.c	6
glib/glib/gstring.c	5
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1

Fuzzer: glib/fuzzing/fuzz_uri_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	710	77.1%
gold	[1:9]	3	0.32%
yellow	[10:29]	14	1.52%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	193	20.9%
All colors	920	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
263	603	g_quark_from_string	call site: 00603	g_uri_to_string
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
51	868	g_utf8_get_char_validated	call site: 00868	test_with_flags
46	277	g_string_sized_new	call site: 00277	parse_userinfo
38	354	g_utf8_validate	call site: 00354	parse_host
30	207	g_error_allocate	call site: 00207	g_warning
27	477	g_string_new	call site: 00477	g_utf8_strdown
26	576	g_quark_to_string	call site: 00576	g_quark_from_string
25	448	g_error_free	call site: 00448	g_hostname_to_ascii
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
17	245	g_strndup	call site: 00245	test_with_flags
13	153	g_logv	call site: 00153	g_utf8_to_utf16

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

308

Reachable functions

411

Percentage of reachable functions covered

25.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_parse.c	2
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	9
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	15
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	18
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/guri.c	23
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gstring.c	9
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1
glib/glib/ghostutils.c	13
glib/glib/guniprop.c	8
glib/glib/gwin32.c	1
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/gunidecomp.c	8
glib/glib/garcbox.c	1

Fuzzer: glib/fuzzing/fuzz_resolver.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	909	84.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	164	15.2%
All colors	1073	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
317	677	g_utf8_validate	call site: 00677	parse_res_txt
142	518	g_memdup2	call site: 00518	g_variant_new_array
120	278	g_error_free	call site: 00278	parse_res_srv
88	400	g_strndup	call site: 00400	g_variant_new_va
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
11	1061	g_strconcat	call site: 01061	g_set_error
9	0	EP	call site: 00000	fuzz_set_logging_func
9	507	g_string_new	call site: 00507	g_memdup2
9	1022	ptr_array_maybe_null_terminate	call site: 01022	g_variant_new

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

385

Reachable functions

505

Percentage of reachable functions covered

23.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_resolver.c	2
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	4
glib/glib/gstrfuncs.c	7
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	4
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/gio/gthreadedresolver.c	7
glib/glib/gvariant.c	39
glib/glib/gvarianttype.c	26
glib/glib/gvariant-core.c	11
glib/glib/gvarianttypeinfo.c	3
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1
glib/glib/gbytes.c	7
glib/glib/gbitlock.c	5
glib/glib/gvariant-serialiser.c	4
glib/glib/garray.c	7
glib/glib/gmem.h	1
glib/glib/glist.c	4