High level conclusions

Fuzzers reach 52.10% of cyclomatic complexity.

Fuzzers reach 44.21% of all functions.

Fuzzer libwget_http_client_fuzzer is blocked:

The runtime code coverage of libwget_http_client_fuzzer covers 9.254% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

2299 / 5200

Cyclomatic complexity statically reachable by fuzzers

23108 / 44346

Runtime code coverage of functions

719 / 5200

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: libwget_base64_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	62	69.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	30.3%
All colors	89	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00016	/src/wget2/libwget/buffer.c:384
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00015	/src/wget2/libwget/buffer_printf.c:346
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00015	/src/wget2/libwget/buffer_printf.c:356
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00016	/src/wget2/libwget/buffer_printf.c:359
0	0	None	0	8	wget_base64_decode_alloc	call site: 00006	/src/wget2/libwget/base64.c:158
0	0	None	0	0	wget_base64_decode_alloc	call site: 00007	/src/wget2/libwget/base64.c:163
0	0	None	0	0	wget_base64_encode_vprintf_alloc	call site: 00011	/src/wget2/libwget/base64.c:278
0	0	None	0	0	wget_buffer_init	call site: 00012	/src/wget2/libwget/buffer.c:155
0	0	None	0	0	wget_buffer_init	call site: 00012	/src/wget2/libwget/buffer.c:161
0	0	None	0	0	wget_buffer_init	call site: 00013	/src/wget2/libwget/buffer.c:164
0	0	None	0	0	wget_vasprintf	call site: 00014	/src/wget2/libwget/printf.c:64

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

13

Reachable functions

33

Percentage of reachable functions covered

60.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_base64_fuzzer.c	1
/src/wget2/libwget/base64.c	11
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/libwget/printf.c	1
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1

Fuzzer: libwget_robots_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	2.27%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	97.7%
All colors	44	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	8	330	wget_robots_parse	call site: 00004	/src/wget2/libwget/robots.c:123
0	0	None	8	330	wget_robots_parse	call site: 00020	/src/wget2/libwget/robots.c:150
0	0	None	8	330	wget_robots_parse	call site: 00026	/src/wget2/libwget/robots.c:156
0	0	None	8	330	wget_robots_parse	call site: 00036	/src/wget2/libwget/robots.c:173
0	0	None	0	37	wget_strncasecmp_ascii	call site: 00008	/src/wget2/libwget/utils.c:161
0	0	None	0	37	wget_strncasecmp_ascii	call site: 00008	/src/wget2/libwget/utils.c:167
0	0	None	0	27	wget_vector_add_memdup	call site: 00028	/src/wget2/libwget/vector.c:224
0	0	None	0	21	wget_vector_add_memdup	call site: 00029	/src/wget2/libwget/vector.c:227
0	0	None	0	16	wget_robots_parse	call site: 00028	/src/wget2/libwget/robots.c:158
0	0	None	0	16	wget_robots_parse	call site: 00037	/src/wget2/libwget/robots.c:175
0	0	None	0	2	wget_vector_create	call site: 00021	/src/wget2/libwget/vector.c:73
0	0	None	0	0	c_strncasecmp	call site: 00009	/src/wget2/lib/c-strncasecmp.c:33

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

4

Reachable functions

25

Percentage of reachable functions covered

84.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_robots_parse_fuzzer.c	1
/src/wget2/libwget/robots.c	5
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/utils.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/./c-ctype.h	1
/src/wget2/libwget/vector.c	7
/src/wget2/libwget/mem.c	2

Fuzzer: libwget_xml_parse_buffer_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	39.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	92	60.5%
All colors	152	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00045	/src/wget2/libwget/buffer_printf.c:75
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00043	/src/wget2/libwget/buffer_printf.c:66
2	2	1 : View List ['gettext']	2	2	wget_xml_parse_file	call site: 00137	/src/wget2/libwget/xml.c:652
0	433	1 : View List ['wget_xml_parse_buffer']	4	437	wget_xml_parse_file	call site: 00139	/src/wget2/libwget/xml.c:665
0	433	1 : View List ['wget_xml_parse_buffer']	0	438	wget_xml_parse_file	call site: 00147	/src/wget2/libwget/xml.c:692
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00017	/src/wget2/libwget/buffer_printf.c:346
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:359
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:363
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00022	/src/wget2/libwget/buffer_printf.c:368
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00025	/src/wget2/libwget/buffer_printf.c:372
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00027	/src/wget2/libwget/buffer_printf.c:377
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00034	/src/wget2/libwget/buffer_printf.c:395

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

20

Reachable functions

60

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_xml_parse_buffer_fuzzer.c	2
/src/wget2/libwget/xml.c	15
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	2
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	2
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1

Fuzzer: libwget_sitemap_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	72	49.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.68%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	72	49.6%
All colors	145	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00046	/src/wget2/libwget/buffer_printf.c:75
25	25	1 : View List ['getHTMLValue']	25	25	getValue	call site: 00105	/src/wget2/libwget/xml.c:251
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00044	/src/wget2/libwget/buffer_printf.c:66
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:346
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:359
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:363
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00023	/src/wget2/libwget/buffer_printf.c:368
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00026	/src/wget2/libwget/buffer_printf.c:372
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00028	/src/wget2/libwget/buffer_printf.c:377
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:395
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:407
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:408

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

15

Reachable functions

54

Percentage of reachable functions covered

72.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_sitemap_url_fuzzer.c	1
/src/wget2/libwget/sitemap_url.c	2
/src/wget2/libwget/xml.c	12
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	1
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	3
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/vector.c	5

Fuzzer: libwget_atom_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	71	41.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	102	58.9%
All colors	173	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00046	/src/wget2/libwget/buffer_printf.c:75
25	25	1 : View List ['getHTMLValue']	25	25	getValue	call site: 00105	/src/wget2/libwget/xml.c:251
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00044	/src/wget2/libwget/buffer_printf.c:66
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00018	/src/wget2/libwget/buffer_printf.c:346
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:359
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00019	/src/wget2/libwget/buffer_printf.c:363
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00023	/src/wget2/libwget/buffer_printf.c:368
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00026	/src/wget2/libwget/buffer_printf.c:372
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00028	/src/wget2/libwget/buffer_printf.c:377
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:395
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:407
0	0	None	450	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:408

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

14

Reachable functions

57

Percentage of reachable functions covered

75.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_atom_url_fuzzer.c	1
/src/wget2/libwget/atom_url.c	2
/src/wget2/libwget/xml.c	12
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	1
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	3
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/vector.c	5
/src/wget2/libwget/rss_url.c	2

Fuzzer: libwget_bar_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	22.9%
gold	[1:9]	2	1.09%
yellow	[10:29]	1	0.54%
greenyellow	[30:49]	1	0.54%
lawngreen	50+	137	74.8%
All colors	183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	179	1 : View List ['wget_human_readable']	0	179	bar_update_speed_stats	call site: 00106	/src/wget2/libwget/bar.c:176
0	17	1 : View List ['wget_buffer_memset_append']	0	35	convert_dec	call site: 00089	/src/wget2/libwget/buffer_printf.c:219
0	2	1 : View List ['wget_malloc']	0	213	wget_bar_vprintf	call site: 00153	/src/wget2/libwget/bar.c:661
0	0	None	22	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:346
0	0	None	22	645	wget_buffer_vprintf_append	call site: 00045	/src/wget2/libwget/buffer_printf.c:377
0	0	None	22	645	wget_buffer_vprintf_append	call site: 00055	/src/wget2/libwget/buffer_printf.c:408
0	0	None	2	344	wget_bar_set_slots	call site: 00016	/src/wget2/libwget/bar.c:499
0	0	None	2	2	wget_strlcpy	call site: 00109	/src/wget2/libwget/strlcpy.c:51
0	0	None	2	2	wget_thread_mutex_init	call site: 00011	/src/wget2/libwget/thread.c:87
0	0	None	0	396	convert_dec	call site: 00071	/src/wget2/libwget/buffer_printf.c:162
0	0	None	0	324	wget_bar_init	call site: 00004	/src/wget2/libwget/bar.c:470
0	0	None	0	324	wget_bar_init	call site: 00009	/src/wget2/libwget/bar.c:471

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

22

Reachable functions

78

Percentage of reachable functions covered

71.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_bar_fuzzer.c	1
/src/wget2/libwget/bar.c	20
/src/wget2/libwget/utils.c	3
/src/wget2/lib/ioctl.c	1
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/printf.c	4
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/gettime.c	1
/src/wget2/libwget/strlcpy.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/mem.c	2

Fuzzer: libwget_utils_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	173	59.0%
gold	[1:9]	1	0.34%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	119	40.6%
All colors	293	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
36	67	8 : View List ['scratch_buffer_init', 'getpwnam_r', 'glob_use_alloca', 'getlogin_r', 'gl_scratch_buffer_grow', 'memchr', 'scratch_buffer_free', 'getenv']	121	939	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:602
17	17	1 : View List ['wget_buffer_memset_append']	17	35	convert_dec	call site: 00258	/src/wget2/libwget/buffer_printf.c:219
17	17	1 : View List ['wget_buffer_memset_append']	17	35	convert_dec	call site: 00261	/src/wget2/libwget/buffer_printf.c:227
16	24	5 : View List ['rpl_realloc', 'strlen', 'rpl_globfree', 'is_dir', 'strcpy']	18	30	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:1149
11	11	1 : View List ['rpl_nanosleep']	11	11	wget_millisleep	call site: 00039	/src/wget2/libwget/utils.c:284
5	5	1 : View List ['glob_lstat']	22	47	glob_in_dir	call site: 00134	/src/wget2/lib/glob.c:1303
2	2	1 : View List ['strchr']	40	202	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:1095
2	2	1 : View List ['strdup']	25	77	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:1120
2	2	2 : View List ['strlen', 'malloc']	13	32	glob_in_dir	call site: 00160	/src/wget2/lib/glob.c:1438
2	2	1 : View List ['__errno_location']	2	2	rpl_glob	call site: 00063	/src/wget2/lib/glob.c:303
0	447	1 : View List ['rpl_glob']	38	671	rpl_glob	call site: 00075	/src/wget2/lib/glob.c:955
0	0	None	306	396	convert_dec	call site: 00240	/src/wget2/libwget/buffer_printf.c:162

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

52

Reachable functions

96

Percentage of reachable functions covered

45.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_utils_fuzzer.c	1
/src/wget2/libwget/utils.c	17
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/./c-ctype.h	4
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/nanosleep.c	1
/src/wget2/lib/gettime.c	1
/src/wget2/libwget/mem.c	1
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/lib/glob.c	10
/src/wget2/lib/free.c	1
/src/wget2/lib/globfree.c	1
/src/wget2/lib/./malloc/scratch_buffer.gl.h	2
/src/wget2/lib/malloc/scratch_buffer_grow.c	1
/src/wget2/lib/./stdlib.h	1
/src/wget2/lib/./glob_internal.h	1
/src/wget2/lib/malloc/scratch_buffer_set_array_size.c	1
/src/wget2/libwget/printf.c	4
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/ioctl.c	1

Fuzzer: libwget_http_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	1.28%
gold	[1:9]	7	2.25%
yellow	[10:29]	1	0.32%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	299	96.1%
All colors	311	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	11	1 : View List ['wget_cookie_free']	0	11	wget_cookie_parse_setcookie	call site: 00268	/src/wget2/libwget/cookie_parse.c:368
0	6	1 : View List ['wget_strmemdup']	0	6	wget_memiconv	call site: 00075	/src/wget2/libwget/encoding.c:76
0	0	None	20	66	wget_memiconv	call site: 00074	/src/wget2/libwget/encoding.c:67
0	0	None	20	66	wget_memiconv	call site: 00074	/src/wget2/libwget/encoding.c:71
0	0	None	20	66	wget_memiconv	call site: 00074	/src/wget2/libwget/encoding.c:73
0	0	None	16	720	wget_http_parse_response_header	call site: 00003	/src/wget2/libwget/http_parse.c:1252
0	0	None	12	12	wget_memiconv	call site: 00077	/src/wget2/libwget/encoding.c:86
0	0	None	6	2482	wget_http_parse_header_line	call site: 00018	/src/wget2/libwget/http_parse.c:1072
0	0	None	6	2476	wget_http_parse_header_line	call site: 00019	/src/wget2/libwget/http_parse.c:1080
0	0	None	2	243	wget_http_parse_link	call site: 00159	/src/wget2/libwget/http_parse.c:299
0	0	None	2	85	wget_striconv	call site: 00072	/src/wget2/libwget/encoding.c:142
0	0	None	2	75	wget_hpkp_pin_add	call site: 00183	/src/wget2/libwget/hpkp.c:85

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

20

Reachable functions

113

Percentage of reachable functions covered

82.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_http_parse_fuzzer.c	1
/src/wget2/libwget/http_parse.c	33
/src/wget2/libwget/../include/wget/wget.h	5
/src/wget2/libwget/log.c	2
/src/wget2/lib/./c-ctype.h	4
/src/wget2/libwget/mem.c	4
/src/wget2/libwget/utils.c	5
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/encoding.c	5
/src/wget2/libwget/vector.c	7
/src/wget2/libwget/hpkp.c	7
/src/wget2/libwget/base64.c	4
/src/wget2/libwget/stringmap.c	2
/src/wget2/libwget/hashmap.c	7
/src/wget2/libwget/cookie_parse.c	4
/src/wget2/libwget/buffer.c	2

Fuzzer: libwget_css_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	373	72.9%
gold	[1:9]	1	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	137	26.8%
All colors	511	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
183	183	1 : View List ['create_safe_uri']	183	183	wget_iri_parse	call site: 00285	/src/wget2/libwget/iri.c:689
91	91	1 : View List ['wget_str_to_utf8']	274	274	wget_iri_parse	call site: 00284	/src/wget2/libwget/iri.c:682
82	82	8 : View List ['fread', '__errno_location', 'getc', 'wget_error_printf_exit', 'yyrealloc', 'clearerr', 'ferror', 'yyrestart']	82	82	yy_get_next_buffer	call site: 00410	/src/wget2/libwget/css_tokenizer.c:3108
4	4	2 : View List ['strrchr', 'strlen']	557	1385	wget_iri_parse	call site: 00038	/src/wget2/libwget/iri.c:609
2	16	2 : View List ['c_isdigit', 'strtoul']	553	1381	wget_iri_parse	call site: 00040	/src/wget2/libwget/iri.c:625
2	2	1 : View List ['strchr']	559	1387	wget_iri_parse	call site: 00037	/src/wget2/libwget/iri.c:600
2	2	1 : View List ['strlen']	8	652	wget_iri_relative_to_abs	call site: 00473	/src/wget2/libwget/iri.c:894
2	2	1 : View List ['__errno_location']	2	2	yylex_init	call site: 00373	/src/wget2/libwget/css_tokenizer.c:3920
0	153	1 : View List ['wget_buffer_printf_append']	0	153	wget_iri_get_connection_part	call site: 00490	/src/wget2/libwget/iri.c:785
0	67	1 : View List ['wget_iri_unescape_inline']	563	1458	wget_iri_parse	call site: 00026	/src/wget2/libwget/iri.c:587
0	37	1 : View List ['normalize_path']	563	1562	wget_iri_parse	call site: 00024	/src/wget2/libwget/iri.c:565
0	0	None	586	645	wget_buffer_vprintf_append	call site: 00294	/src/wget2/libwget/buffer_printf.c:346

Runtime coverage analysis

Covered functions

71

Functions that are reachable but not covered

108

Reachable functions

178

Percentage of reachable functions covered

39.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_css_url_fuzzer.c	1
/src/wget2/libwget/iri.c	10
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/utils.c	3
/src/wget2/libwget/log.c	3
/src/wget2/libwget/encoding.c	5
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/mem.c	1
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/buffer.c	11
/src/wget2/libwget/buffer_printf.c	11
/src/wget2/libwget/css_url.c	4
/src/wget2/libwget/css.c	3
/src/wget2/libwget/css_tokenizer.c	21
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/vector.c	8
/src/wget2/libwget/strscpy.c	1

Fuzzer: libwget_ocsp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	139	48.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.69%
lawngreen	50+	145	50.6%
All colors	286	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__errno_location', 'fileno', '__freading', 'lseek', 'rpl_fflush']	35	35	rpl_fclose	call site: 00151	/src/wget2/lib/fclose.c:66
16	16	1 : View List ['wget_hashmap_remove']	16	30	ocsp_db_add_fingerprint_entry	call site: 00249	/src/wget2/libwget/ocsp.c:282
16	16	1 : View List ['wget_hashmap_remove']	16	30	ocsp_db_add_host_entry	call site: 00227	/src/wget2/libwget/ocsp.c:347
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00038	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00135	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00202	/src/wget2/libwget/io.c:123
2	2	1 : View List ['gettext']	2	2	wget_ocsp_db_load	call site: 00267	/src/wget2/libwget/ocsp.c:521
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00190	/src/wget2/libwget/io.c:520
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00037	/src/wget2/libwget/buffer_printf.c:346
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00042	/src/wget2/libwget/buffer_printf.c:368
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00045	/src/wget2/libwget/buffer_printf.c:372
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00047	/src/wget2/libwget/buffer_printf.c:377

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

47

Reachable functions

112

Percentage of reachable functions covered

58.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_ocsp_fuzzer.c	2
/src/wget2/libwget/ocsp.c	16
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/hashmap.c	12
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/libwget/io.c	4
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1

Fuzzer: libwget_tlssess_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	130	50.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.77%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	125	48.6%
All colors	257	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__errno_location', 'fileno', '__freading', 'lseek', 'rpl_fflush']	35	35	rpl_fclose	call site: 00138	/src/wget2/lib/fclose.c:66
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00027	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00122	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00190	/src/wget2/libwget/io.c:123
2	2	1 : View List ['gettext']	2	2	wget_tls_session_db_load	call site: 00180	/src/wget2/libwget/tls_session.c:354
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00177	/src/wget2/libwget/io.c:520
0	9	1 : View List ['wget_tls_session_free']	0	31	wget_tls_session_db_add	call site: 00219	/src/wget2/libwget/tls_session.c:219
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00026	/src/wget2/libwget/buffer_printf.c:346
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00031	/src/wget2/libwget/buffer_printf.c:368
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00034	/src/wget2/libwget/buffer_printf.c:372
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00036	/src/wget2/libwget/buffer_printf.c:377
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00043	/src/wget2/libwget/buffer_printf.c:395

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

45

Reachable functions

111

Percentage of reachable functions covered

59.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_tlssess_fuzzer.c	2
/src/wget2/libwget/tls_session.c	12
/src/wget2/libwget/hashmap.c	13
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/io.c	4
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/mem.c	2
/src/wget2/libwget/base64.c	3

Fuzzer: libwget_hsts_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	50.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	1.14%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	126	47.9%
All colors	263	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__errno_location', 'fileno', '__freading', 'lseek', 'rpl_fflush']	35	35	rpl_fclose	call site: 00142	/src/wget2/lib/fclose.c:66
16	16	1 : View List ['wget_hashmap_remove']	16	34	hsts_db_add_entry	call site: 00220	/src/wget2/libwget/hsts.c:266
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00031	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00126	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00194	/src/wget2/libwget/io.c:123
2	2	1 : View List ['gettext']	2	2	wget_hsts_db_load	call site: 00184	/src/wget2/libwget/hsts.c:458
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00181	/src/wget2/libwget/io.c:520
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00030	/src/wget2/libwget/buffer_printf.c:346
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:368
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00038	/src/wget2/libwget/buffer_printf.c:372
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00040	/src/wget2/libwget/buffer_printf.c:377
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00047	/src/wget2/libwget/buffer_printf.c:395

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

50

Reachable functions

112

Percentage of reachable functions covered

55.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_hsts_fuzzer.c	2
/src/wget2/libwget/hsts.c	12
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/hashmap.c	12
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/io.c	4
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/ip.c	1

Fuzzer: libwget_hpkp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	129	46.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.35%
greenyellow	[30:49]	3	1.07%
lawngreen	50+	147	52.5%
All colors	280	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__errno_location', 'fileno', '__freading', 'lseek', 'rpl_fflush']	35	35	rpl_fclose	call site: 00139	/src/wget2/lib/fclose.c:66
11	11	1 : View List ['buffer_realloc']	11	11	wget_buffer_memcat	call site: 00028	/src/wget2/libwget/buffer.c:384
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00123	/src/wget2/lib/fopen.c:211
7	7	2 : View List ['wget_calloc.692', 'hashmap_rehash']	7	7	hashmap_new_entry	call site: 00216	/src/wget2/libwget/hashmap.c:249
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00191	/src/wget2/libwget/io.c:123
2	2	1 : View List ['gettext']	2	2	wget_hpkp_db_check_pubkey	call site: 00260	/src/wget2/libwget/hpkp_db.c:158
2	2	1 : View List ['gettext']	2	2	wget_hpkp_db_load	call site: 00181	/src/wget2/libwget/hpkp_db.c:359
0	34	1 : View List ['rpl_fclose']	2	36	wget_update_file	call site: 00178	/src/wget2/libwget/io.c:520
0	7	1 : View List ['nettle_sha256_compress']	0	12	nettle_sha256_update	call site: 00000	/src/nettle/sha256.c:111
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00027	/src/wget2/libwget/buffer_printf.c:346
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00032	/src/wget2/libwget/buffer_printf.c:368
0	0	None	161	645	wget_buffer_vprintf_append	call site: 00035	/src/wget2/libwget/buffer_printf.c:372

Runtime coverage analysis

Covered functions

87

Functions that are reachable but not covered

48

Reachable functions

127

Percentage of reachable functions covered

62.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_hpkp_fuzzer.c	2
/src/wget2/libwget/hpkp_db.c	9
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/mem.c	2
/src/wget2/libwget/hashmap.c	11
/src/wget2/libwget/hpkp.c	5
/src/wget2/libwget/vector.c	8
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/io.c	4
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	5
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	1
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/log.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/base64.c	4
/src/wget2/libwget/hashfile.c	5

Fuzzer: libwget_iri_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	124	24.7%
gold	[1:9]	1	0.19%
yellow	[10:29]	1	0.19%
greenyellow	[30:49]	5	0.99%
lawngreen	50+	371	73.9%
All colors	502	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00209	/src/libidn2/lib/idna.c:233
6	927	9 : View List ['__errno_location', 'idn2_punycode_decode', 'u32_to_u8', 'u32_normalize', 'get_map_data', 'map_is', 'get_idna_map', 'malloc', '_idn2_label_test']	6	967	_tr46	call site: 00107	/src/libidn2/lib/lookup.c:288
6	6	1 : View List ['__errno_location']	6	14	u32_normalize	call site: 00154	/src/libunistring/lib/uninorm/u-normalize-internal.h:345
4	4	2 : View List ['__errno_location', 'gettext']	6	6	wget_memiconv	call site: 00066	/src/wget2/libwget/encoding.c:92
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00183	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00156	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['__errno_location']	2	2	u32_to_u8	call site: 00172	/src/libunistring/lib/unistr/u32-to-u8.c:111
2	2	2 : View List ['__errno_location', 'malloc']	2	2	u8_to_u32	call site: 00094	/src/libunistring/lib/unistr/u8-to-u32.c:100
0	23	2 : View List ['get_idna_map', 'map_is']	0	23	_idn2_label_test	call site: 00234	/src/libidn2/lib/idna.c:285
0	17	1 : View List ['wget_buffer_memset_append']	0	35	convert_dec	call site: 00354	/src/wget2/libwget/buffer_printf.c:219
0	17	1 : View List ['wget_buffer_memset_append']	0	35	convert_dec	call site: 00357	/src/wget2/libwget/buffer_printf.c:227

Runtime coverage analysis

Covered functions

133

Functions that are reachable but not covered

31

Reachable functions

159

Percentage of reachable functions covered

80.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_iri_fuzzer.c	2
/src/wget2/libwget/iri.c	27
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/../include/wget/wget.h	2
/src/wget2/libwget/utils.c	3
/src/wget2/libwget/log.c	2
/src/wget2/libwget/encoding.c	6
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/mem.c	3
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/buffer.c	11
/src/wget2/libwget/buffer_printf.c	11
/src/wget2/libwget/strscpy.c	1
/src/wget2/libwget/printf.c	2

Fuzzer: libwget_netrc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	30	26.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.75%
lawngreen	50+	82	71.9%
All colors	114	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33	33	5 : View List ['__errno_location', 'fileno', '__freading', 'lseek', 'rpl_fflush']	35	35	rpl_fclose	call site: 00050	/src/wget2/lib/fclose.c:66
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00019	/src/wget2/lib/fopen.c:211
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00036	/src/wget2/libwget/io.c:123
0	0	None	34	388	wget_netrc_db_load	call site: 00017	/src/wget2/libwget/netrc.c:197
0	0	None	34	355	wget_netrc_db_load	call site: 00018	/src/wget2/libwget/netrc.c:200
0	0	None	34	355	wget_netrc_db_load	call site: 00047	/src/wget2/libwget/netrc.c:235
0	0	None	12	12	getline_internal	call site: 00031	/src/wget2/libwget/io.c:67
0	0	None	10	10	getline_internal	call site: 00032	/src/wget2/libwget/io.c:72
0	0	None	2	2	wget_strcmp	call site: 00007	/src/wget2/libwget/utils.c:79
0	0	None	2	2	wget_strcmp	call site: 00007	/src/wget2/libwget/utils.c:85
0	0	None	0	47	wget_netrc_db_add	call site: 00070	/src/wget2/libwget/netrc.c:160
0	0	None	0	37	wget_netrc_db_add	call site: 00070	/src/wget2/libwget/netrc.c:163

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

25

Reachable functions

66

Percentage of reachable functions covered

62.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_netrc_fuzzer.c	2
/src/wget2/libwget/netrc.c	12
/src/wget2/libwget/hashmap.c	11
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/utils.c	2
/src/wget2/lib/fopen.c	2
/src/wget2/libwget/io.c	3
/src/wget2/libwget/log.c	2
/src/wget2/libwget/mem.c	3
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/./c-ctype.h	1

Fuzzer: libwget_html_url_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	137	43.7%
gold	[1:9]	1	0.31%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	175	55.9%
All colors	313	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
82	82	8 : View List ['fread', '__errno_location', 'getc', 'wget_error_printf_exit', 'yyrealloc', 'clearerr', 'ferror', 'yyrestart']	82	82	yy_get_next_buffer	call site: 00210	/src/wget2/libwget/css_tokenizer.c:3108
2	2	1 : View List ['__errno_location']	2	2	yylex_init	call site: 00173	/src/wget2/libwget/css_tokenizer.c:3920
0	54	1 : View List ['getToken']	0	54	getValue	call site: 00106	/src/wget2/libwget/xml.c:251
0	6	1 : View List ['wget_strmemdup']	0	83	wget_http_parse_content_type	call site: 00147	/src/wget2/libwget/http_parse.c:481
0	0	None	50	1309	html_get_url	call site: 00166	/src/wget2/libwget/html_url.c:209
0	0	None	12	99	yylex	call site: 00206	/src/wget2/libwget/css_tokenizer.c:2651
0	0	None	12	97	yylex	call site: 00206	/src/wget2/libwget/css_tokenizer.c:2990
0	0	None	12	97	yylex	call site: 00209	/src/wget2/libwget/css_tokenizer.c:3027
0	0	None	10	1104	parseXML	call site: 00005	/src/wget2/libwget/xml.c:445
0	0	None	10	1104	parseXML	call site: 00013	/src/wget2/libwget/xml.c:466
0	0	None	10	1104	parseXML	call site: 00089	/src/wget2/libwget/xml.c:488
0	0	None	10	1104	parseXML	call site: 00105	/src/wget2/libwget/xml.c:535

Runtime coverage analysis

Covered functions

65

Functions that are reachable but not covered

42

Reachable functions

107

Percentage of reachable functions covered

60.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_html_url_fuzzer.c	1
/src/wget2/libwget/html_url.c	4
/src/wget2/libwget/xml.c	13
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	3
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	6
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/buffer_printf.c	9
/src/wget2/lib/./c-ctype.h	4
/src/wget2/libwget/utils.c	2
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/http_parse.c	6
/src/wget2/libwget/vector.c	8
/src/wget2/libwget/css.c	3
/src/wget2/libwget/css_tokenizer.c	21
/src/wget2/lib/free.c	1
/src/wget2/libwget/strscpy.c	1

Fuzzer: libwget_cookie_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	446	54.7%
gold	[1:9]	4	0.49%
yellow	[10:29]	2	0.24%
greenyellow	[30:49]	1	0.12%
lawngreen	50+	361	44.3%
All colors	814	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
642	642	3 : View List ['psl_idna_open', 'psl_idna_toASCII', 'psl_idna_close']	676	758	is_public_suffix	call site: 00095	/src/libpsl/src/psl.c:868
183	183	1 : View List ['create_safe_uri']	183	183	wget_iri_parse	call site: 00756	/src/wget2/libwget/iri.c:689
91	91	1 : View List ['wget_str_to_utf8']	274	274	wget_iri_parse	call site: 00755	/src/wget2/libwget/iri.c:682
37	37	1 : View List ['normalize_path']	600	1562	wget_iri_parse	call site: 00693	/src/wget2/libwget/iri.c:565
24	24	2 : View List ['vector_get', 'vector_find']	28	28	is_public_suffix	call site: 00294	/src/libpsl/src/psl.c:887
10	10	4 : View List ['close', 'open', 'fdopen', '__errno_location']	10	10	rpl_fopen	call site: 00373	/src/wget2/lib/fopen.c:211
10	10	4 : View List ['wget_realloc.343', '__errno_location', 'memchr', 'gettext']	10	10	getline_internal	call site: 00432	/src/wget2/libwget/io.c:82
10	10	4 : View List ['wget_realloc.343', '__errno_location', 'memchr', 'gettext']	10	10	getline_internal	call site: 00433	/src/wget2/libwget/io.c:101
6	6	2 : View List ['__errno_location', 'gettext']	8	42	wget_update_file	call site: 00418	/src/wget2/libwget/io.c:509
6	6	2 : View List ['__errno_location', 'gettext']	6	6	getline_internal	call site: 00435	/src/wget2/libwget/io.c:123
4	4	2 : View List ['strrchr', 'strlen']	557	1385	wget_iri_parse	call site: 00707	/src/wget2/libwget/iri.c:609
2	16	2 : View List ['c_isdigit', 'strtoul']	553	1381	wget_iri_parse	call site: 00709	/src/wget2/libwget/iri.c:625

Runtime coverage analysis

Covered functions

132

Functions that are reachable but not covered

150

Reachable functions

282

Percentage of reachable functions covered

46.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_cookie_fuzzer.c	2
/src/wget2/libwget/cookie_parse.c	11
/src/wget2/libwget/mem.c	3
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/http_parse.c	7
/src/wget2/libwget/printf.c	6
/src/wget2/libwget/buffer.c	8
/src/wget2/libwget/buffer_printf.c	11
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/cookie.c	15
/src/wget2/libwget/log.c	2
/src/libpsl/src/psl.c	23
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libpsl/src/lookup_string_in_fixed_set.c	10
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/vector.c	14
/src/wget2/libwget/io.c	4
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/lib/xmalloc.c	2
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/lib/fopen.c	2
/src/wget2/lib/fclose.c	1
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/libwget/utils.c	5
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/iri.c	8
/src/wget2/libwget/encoding.c	5
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1

Fuzzer: libwget_metalink_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	152	29.1%
gold	[1:9]	1	0.19%
yellow	[10:29]	4	0.76%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	365	69.9%
All colors	522	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00375	/src/libidn2/lib/idna.c:233
34	34	1 : View List ['wget_buffer_memset_append']	34	88	copy_string	call site: 00047	/src/wget2/libwget/buffer_printf.c:75
25	25	1 : View List ['getHTMLValue']	25	25	getValue	call site: 00106	/src/wget2/libwget/xml.c:251
6	927	9 : View List ['__errno_location', 'idn2_punycode_decode', 'u32_to_u8', 'u32_normalize', 'get_map_data', 'map_is', 'get_idna_map', 'malloc', '_idn2_label_test']	6	967	_tr46	call site: 00273	/src/libidn2/lib/lookup.c:288
6	6	1 : View List ['__errno_location']	6	14	u32_normalize	call site: 00320	/src/libunistring/lib/uninorm/u-normalize-internal.h:345
6	6	1 : View List ['wget_strmemdup']	6	6	wget_memiconv	call site: 00227	/src/wget2/libwget/encoding.c:76
4	4	2 : View List ['__errno_location', 'gettext']	6	6	wget_memiconv	call site: 00232	/src/wget2/libwget/encoding.c:92
2	2	1 : View List ['strlen']	36	108	copy_string	call site: 00045	/src/wget2/libwget/buffer_printf.c:66
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00349	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00322	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['__errno_location']	2	2	u32_to_u8	call site: 00338	/src/libunistring/lib/unistr/u32-to-u8.c:111

Runtime coverage analysis

Covered functions

140

Functions that are reachable but not covered

37

Reachable functions

171

Percentage of reachable functions covered

78.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_metalink_parse_fuzzer.c	1
/src/wget2/libwget/metalink.c	9
/src/wget2/libwget/../include/wget/wget.h	3
/src/wget2/libwget/xml.c	12
/src/wget2/libwget/strlcpy.c	1
/src/wget2/libwget/log.c	2
/src/wget2/libwget/printf.c	2
/src/wget2/libwget/buffer.c	8
/src/wget2/libwget/buffer_printf.c	10
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/utils.c	3
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/c-strncasecmp.c	1
/src/wget2/libwget/mem.c	4
/src/wget2/libwget/vector.c	12
/src/wget2/libwget/strscpy.c	1
/src/wget2/libwget/iri.c	9
/src/wget2/libwget/encoding.c	5
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u-cpy.h	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/libunistring/lib/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1

Fuzzer: wget_options_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	866	53.1%
gold	[1:9]	34	2.08%
yellow	[10:29]	23	1.41%
greenyellow	[30:49]	6	0.36%
lawngreen	50+	700	42.9%
All colors	1629	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1926	5487	9 : View List ['wget_tcp_set_bind_address', 'wget_cookie_db_save', 'wget_http_set_no_proxy', 'wget_ssl_deinit', 'wget_cookie_db_free', 'wget_http_set_https_proxy', 'wget_net_deinit', 'wget_http_set_http_proxy', 'wget_dns_cache_free']	1928	5531	wget_global_deinit	call site: 01278	/src/wget2/libwget/init.c:205
779	779	5 : View List ['load_system_priority_file', '_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'update_system_wide_priority_string']	879	879	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['check_padlock', '_gnutls_log', 'gnutls_crypto_single_cipher_register', 'check_avx_movbe', 'check_fast_pclmul', 'read_cpuid_vals', 'check_phe_partial', 'padlock_capability', 'check_ssse3', 'gnutls_crypto_single_mac_register', 'check_optimized_aes', 'check_sha', 'check_phe_sha512', 'capabilities_to_intel_cpuid', 'gnutls_crypto_single_digest_register', '_gnutls_priority_update_non_aesni', 'check_pclmul', 'capabilities_to_zhaoxin_edx', 'check_phe']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00808	/src/libidn2/lib/idna.c:233
32	41	10 : View List ['readdir', 'glob_use_alloca', 'strdup', 'fnmatch', 'is_dir', 'convert_dirent', 'dirfd', 'fstatat', 'gl_scratch_buffer_set_array_size', 'readdir_result_type']	47	75	glob_in_dir	call site: 00197	/src/wget2/lib/glob.c:1337
18	73	7 : View List ['rpl_realloc', 'rpl_globfree', 'strlen', 'qsort', 'strdup', 'is_dir', 'strcpy']	18	77	rpl_glob	call site: 00131	/src/wget2/lib/glob.c:990
18	25	6 : View List ['rpl_realloc', 'strlen', 'qsort', 'strdup', 'is_dir', 'strcpy']	18	69	rpl_glob	call site: 00131	/src/wget2/lib/glob.c:1045
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
17	26	5 : View List ['getpwnam_r', 'scratch_buffer_free', 'gl_scratch_buffer_grow', 'getlogin_r', 'scratch_buffer_init']	52	878	rpl_glob	call site: 00131	/src/wget2/lib/glob.c:611
16	16	1 : View List ['_asn1_delete_list_and_nodes']	16	16	asn1_array2tree	call site: 00000	/src/gnutls/lib/minitasn1/structure.c:272
12	12	2 : View List ['_gnutls_log', 'atoi']	22	1563	lib_init	call site: 00000	/src/gnutls/lib/global.c:520

Runtime coverage analysis

Covered functions

376

Functions that are reachable but not covered

259

Reachable functions

512

Percentage of reachable functions covered

49.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/wget_options_fuzzer.c	3
/src/wget2/src/options.c	25
/src/wget2/libwget/log.c	4
/src/wget2/libwget/utils.c	11
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/lib/./c-ctype.h	7
/src/wget2/libwget/vector.c	13
/src/wget2/src/plugin.c	11
/src/wget2/libwget/../include/wget/wget.h	4
/src/wget2/src/dl.c	10
/src/wget2/libwget/stringmap.c	2
/src/wget2/libwget/hashmap.c	11
/src/wget2/src/../include/wget/wget.h	6
/src/wget2/src/testing.c	2
/src/wget2/libwget/mem.c	5
/src/wget2/lib/glob.c	10
/src/wget2/lib/free.c	1
/src/wget2/lib/globfree.c	1
/src/wget2/lib/./malloc/scratch_buffer.gl.h	2
/src/wget2/lib/malloc/scratch_buffer_grow.c	1
/src/wget2/lib/./stdlib.h	1
/src/wget2/lib/./glob_internal.h	1
/src/wget2/lib/malloc/scratch_buffer_set_array_size.c	1
/src/wget2/libwget/printf.c	7
/src/wget2/libwget/buffer.c	9
/src/wget2/libwget/buffer_printf.c	10
/src/wget2/src/utils.c	1
/src/wget2/src/log.c	1
/src/wget2/libwget/console.c	3
/src/wget2/lib/fflush.c	2
/src/wget2/lib/fseeko.c	1
/src/wget2/src/./wget_dl.h	2
/src/wget2/libwget/strscpy.c	1
/src/wget2/lib/fopen.c	2
/src/wget2/libwget/io.c	4
/src/wget2/lib/fclose.c	1
/src/wget2/libwget/iri.c	11
/src/wget2/lib/./xgetaname-impl.h	1
/src/wget2/lib/xmalloc.c	5
/src/wget2/lib/./ialloc.h	2
/src/wget2/lib/xalloc-die.c	1
/src/wget2/libwget/encoding.c	6
/src/wget2/libwget/http.c	7
/src/libidn2/lib/lookup.c	6
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/gnutls/lib/unistring/unistr/u8-to-u32.c	1
/src/gnutls/lib/unistring/unistr/u8-mbtoucr.c	1
/src/libidn2/lib/tr46map.c	7
/src/gnutls/lib/unistring/uninorm/u-normalize-internal.h	1
/src/gnutls/lib/unistring/unistr/u32-mbtouc-unsafe.c	1
/src/gnutls/lib/unistring/unictype/combiningclass.c	1
/src/gnutls/lib/unistring/./array-mergesort.h	3
/src/gnutls/lib/unistring/unistr/u32-uctomb.c	1
/src/gnutls/lib/unistring/unistr/u-cpy.h	1
/src/gnutls/lib/unistring/unistr/u32-to-u8.c	1
/src/gnutls/lib/unistring/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/gnutls/lib/unistring/unictype/categ_test.c	1
/src/gnutls/lib/unistring/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/gnutls/lib/unistring/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/http_parse.c	2
/src/wget2/libwget/net.c	13
/src/wget2/lib/sockets.c	2
/src/wget2/libwget/dns.c	13
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/dns_cache.c	7
/src/wget2/libwget/ssl_gnutls.c	6
/src/wget2/src/stats_server.c	8
/src/wget2/src/stats_site.c	3
/src/wget2/lib/gettime.c	1
/src/wget2/lib/nanosleep.c	1
/src/wget2/libwget/logger.c	1
/src/wget2/libwget/init.c	2
/src/wget2/libwget/cookie.c	7
/src/wget2/lib/basename.c	1
/src/wget2/lib/basename-lgpl.c	2
/src/wget2/libwget/cookie_parse.c	6
/src/wget2/lib/c-strncasecmp.c	1
/src/libpsl/src/psl.c	9
/src/libpsl/src/lookup_string_in_fixed_set.c	9
/src/gnutls/lib/cert-cred.c	2
/src/gnutls/lib/x509/verify-high.c	1
/src/gnutls/lib/x509/x509.c	1
/src/gnutls/lib/minitasn1/structure.c	4
/src/gnutls/lib/minitasn1/parser_aux.c	4
/src/gnutls/lib/minitasn1/./parser_aux.h	1
/src/gnutls/lib/minitasn1/./gstr.h	1
/src/gnutls/lib/x509/x509_ext.c	2
/src/gnutls/lib/x509/crl.c	1
/src/gnutls/lib/pcert.c	1
/src/gnutls/lib/pubkey.c	1
/src/gnutls/lib/pk.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	1
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/./str_array.h	1
/src/gnutls/lib/privkey.c	1
/src/gnutls/lib/x509/privkey.c	2
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/dh.c	1
/src/gnutls/lib/priority.c	3
/src/gnutls/lib/global.c	2
/src/gnutls/lib/errors.c	1
/src/gnutls/lib/system/keys-dummy.c	1
/src/gnutls/lib/nettle/init.c	1
/src/gmp/mp_set_fns.c	1
/src/gnutls/lib/compress.c	1
/src/gnutls/lib/random.c	1
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/nettle/sysrng-linux.c	1
/src/gnutls/lib/hello_ext.c	1
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/system.c	1
/src/gnutls/lib/accelerated/cryptodev.c	1
/src/gnutls/lib/supplemental.c	1
/src/gnutls/lib/./name_val_array.h	1
/src/gnutls/lib/kx.c	1
/src/wget2/libwget/hsts.c	2
/src/wget2/libwget/hpkp_db.c	2
/src/wget2/libwget/tls_session.c	2
/src/wget2/libwget/ocsp.c	2
/src/wget2/libwget/netrc.c	2

Fuzzer: libwget_http_client_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10296	95.7%
gold	[1:9]	130	1.20%
yellow	[10:29]	4	0.03%
greenyellow	[30:49]	1	0.00%
lawngreen	50+	317	2.94%
All colors	10748	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
30925	41369	5 : View List ['wget_tcp_set_ssl_hostname', 'wget_tcp_set_ssl', 'wget_http_close', 'establish_proxy_connect', 'wget_tcp_tls_start']	30925	41402	wget_http_open	call site: 00442	/src/wget2/libwget/http.c:604
20253	41096	11 : View List ['__errno_location', 'tcp_connect', 'debug_addr', 'socket', 'wget_tcp_close', 'set_socket_options', 'print_error_host', 'bind', 'close', 'gettext', 'wget_ssl_open']	20253	41151	wget_tcp_connect	call site: 00559	/src/wget2/libwget/net.c:810
10554	10554	1 : View List ['wget_ssl_read_timeout']	10558	10558	wget_tcp_read	call site: 08655	/src/wget2/libwget/net.c:906
10398	10398	1 : View List ['wget_ssl_write_timeout']	10398	10398	wget_tcp_write	call site: 08613	/src/wget2/libwget/net.c:957
779	779	5 : View List ['load_system_priority_file', '_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'update_system_wide_priority_string']	879	879	_gnutls_update_system_priorities	call site: 01052	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['check_padlock', '_gnutls_log', 'gnutls_crypto_single_cipher_register', 'check_avx_movbe', 'check_fast_pclmul', 'read_cpuid_vals', 'check_phe_partial', 'padlock_capability', 'check_ssse3', 'gnutls_crypto_single_mac_register', 'check_optimized_aes', 'check_sha', 'check_phe_sha512', 'capabilities_to_intel_cpuid', 'gnutls_crypto_single_digest_register', '_gnutls_priority_update_non_aesni', 'check_pclmul', 'capabilities_to_zhaoxin_edx', 'check_phe']	725	2055	register_x86_padlock_crypto	call site: 00899	/src/gnutls/lib/accelerated/x86/x86-common.c:383
183	183	1 : View List ['create_safe_uri']	183	183	wget_iri_parse	call site: 00276	/src/wget2/libwget/iri.c:689
163	163	1 : View List ['wget_iri_escape_path']	163	199	wget_iri_get_escaped_resource	call site: 00367	/src/wget2/libwget/iri.c:1198
94	287	4 : View List ['wget_thread_mutex_lock', 'wget_millisleep', 'wget_dns_cache_get', 'resolve']	197	408	wget_dns_resolve	call site: 00464	/src/wget2/libwget/dns.c:380
91	91	1 : View List ['wget_str_to_utf8']	274	274	wget_iri_parse	call site: 00275	/src/wget2/libwget/iri.c:682
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00791	/src/gnutls/lib/accelerated/x86/x86-common.c:817
37	37	1 : View List ['normalize_path']	600	1562	wget_iri_parse	call site: 00023	/src/wget2/libwget/iri.c:565

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

1814

Reachable functions

1999

Percentage of reachable functions covered

9.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/wget2/fuzz/libwget_http_client_fuzzer.c	7
/src/wget2/libwget/iri.c	13
/src/wget2/lib/./c-ctype.h	10
/src/wget2/libwget/../include/wget/wget.h	5
/src/wget2/libwget/utils.c	11
/src/wget2/libwget/log.c	5
/src/wget2/libwget/encoding.c	6
/src/wget2/lib/c-strcasecmp.c	1
/src/wget2/libwget/mem.c	4
/src/libidn2/lib/lookup.c	7
/src/libunistring/lib/unistr/u8-strlen.c	1
/src/gnutls/lib/unistring/unistr/u8-to-u32.c	1
/src/gnutls/lib/unistring/unistr/u8-mbtoucr.c	1
/src/libidn2/lib/tr46map.c	7
/src/wget2/lib/free.c	1
/src/gnutls/lib/unistring/uninorm/u-normalize-internal.h	2
/src/gnutls/lib/unistring/unistr/u32-mbtouc-unsafe.c	1
/src/gnutls/lib/unistring/unictype/combiningclass.c	1
/src/gnutls/lib/unistring/./array-mergesort.h	3
/src/gnutls/lib/unistring/unistr/u32-uctomb.c	1
/src/gnutls/lib/unistring/unistr/u-cpy.h	2
/src/gnutls/lib/unistring/unistr/u32-to-u8.c	1
/src/gnutls/lib/unistring/unistr/u8-uctomb.c	1
/src/libidn2/lib/punycode.c	5
/src/libidn2/lib/idna.c	4
/src/gnutls/lib/unistring/unictype/categ_test.c	1
/src/gnutls/lib/unistring/unictype/bitmap.h	1
/src/libidn2/lib/tables.c	6
/src/libidn2/lib/context.c	4
/src/libunistring/lib/unictype/joiningtype_of.c	1
/src/gnutls/lib/unistring/unictype/categ_of.c	2
/src/libunistring/lib/unictype/scripts.c	1
/src/libidn2/lib/bidi.c	2
/src/libunistring/lib/unictype/bidi_of.c	2
/src/libunistring/lib/unistr/u32-cmp.c	1
/src/libidn2/lib/error.c	1
/src/wget2/libwget/ip.c	1
/src/wget2/libwget/buffer.c	12
/src/wget2/libwget/buffer_printf.c	11
/src/wget2/libwget/net.c	18
/src/wget2/libwget/http.c	21
/src/wget2/libwget/strscpy.c	1
/src/wget2/libwget/vector.c	13
/src/wget2/libwget/http_parse.c	35
/src/wget2/libwget/thread.c	4
/src/wget2/libwget/logger.c	1
/src/wget2/libwget/dns.c	5
/src/wget2/lib/gettime.c	1
/src/wget2/libwget/dns_cache.c	2
/src/wget2/libwget/hashmap.c	10
/src/wget2/libwget/printf.c	4
/src/wget2/lib/nanosleep.c	1
/src/wget2/libwget/ssl_gnutls.c	24
/src/wget2/libwget/ssl.c	2
/src/gnutls/lib/global.c	5
/src/gnutls/lib/errors.c	4
/src/gnutls/lib/./fips.h	5
/src/gnutls/lib/nettle/init.c	3
/src/gmp/mp_get_fns.c	1
/src/gmp/mp_set_fns.c	1
/src/gnutls/lib/system/keys-dummy.c	3
/src/gnutls/lib/minitasn1/version.c	1
/src/gnutls/lib/minitasn1/structure.c	12
/src/gnutls/lib/minitasn1/./int.h	3
/src/gnutls/lib/minitasn1/parser_aux.c	20
/src/gnutls/lib/minitasn1/gstr.c	2
/src/gnutls/lib/minitasn1/./parser_aux.h	1
/src/gnutls/lib/minitasn1/./gstr.h	1
/src/gnutls/lib/minitasn1/element.c	6
/src/gnutls/lib/minitasn1/coding.c	15
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/random.c	5
/src/gnutls/lib/nettle/sysrng-linux.c	2
/src/gnutls/gl/./gl_list.h	5
/src/gnutls/lib/hello_ext.c	22
/src/gnutls/lib/system.c	1
/src/gnutls/lib/atfork.c	2
/src/gnutls/lib/accelerated/accelerated.c	1
/src/gnutls/lib/accelerated/x86/x86-common.c	19
/usr/local/lib/clang/18/include/cpuid.h	3
/src/gnutls/lib/crypto-backend.c	8
/src/gnutls/lib/priority.c	37
/src/gnutls/lib/accelerated/cryptodev.c	1
/src/gnutls/lib/accelerated/afalg.c	1
/src/wget2/lib/fopen.c	2
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/algorithms/mac.c	13
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/algorithms/sign.c	17
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/lib/profiles.c	2
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/cipher_int.c	8
/src/wget2/lib/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/str.c	32
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	18
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/state.c	21
/src/gnutls/lib/cert-session.c	6
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/./gnutls_int.h	5
/src/gnutls/lib/x509/x509.c	58
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509_b64.c	5
/src/nettle/base64-decode.c	4
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/./common.h	2
/src/gnutls/lib/minitasn1/decoding.c	21
/src/gnutls/lib/x509/common.c	35
/src/gnutls/lib/x509/extensions.c	7
/src/gnutls/lib/x509/dn.c	8
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/str-iconv.c	3
/src/gnutls/lib/unistring/unistr/u16-to-u8.c	1
/src/gnutls/lib/unistring/unistr/u16-mbtoucr.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	2
/src/libidn2/lib/free.c	1
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/ocsp-api.c	3
/src/gnutls/lib/x509/tls_features.c	5
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	6
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/x509/ocsp.c	26
/src/gnutls/lib/x509/./../algorithms.h	8
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/algorithms/publickey.c	8
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/pubkey.c	23
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/mpi.c	11
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/./datum.h	2
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	4
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/attributes.c	1
/src/libidn2/lib/decode.c	2
/src/libunistring/lib/unistr/u-cpy-alloc.h	1
/src/libunistring/lib/unistr/u-strlen.h	1
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	25
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/crypto-api.c	19
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/verify.c	20
/src/gnutls/lib/x509/crl.c	11
/src/gnutls/lib/algorithms/./../algorithms.h	5
/src/gnutls/lib/x509/./ip-in-cidr.h	1
/src/gnutls/lib/x509/supported_exts.gperf	2
/src/gnutls/lib/x509/hostname-verify.c	4
/src/gnutls/lib/x509/email-verify.c	1
/src/wget2/libwget/ocsp.c	10
/src/wget2/libwget/hpkp_db.c	1
/src/wget2/libwget/hashfile.c	5
/src/gnutls/lib/record.c	22
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/alert.c	3
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/pcert.c	6
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/privkey.c	14
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/kx.c	19
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	4
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/server_name.c	4
/src/gnutls/lib/hello_ext_lib.c	3
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	2
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/wget2/libwget/io.c	3
/src/gnutls/lib/ext/ext_master_secret.c	1
/src/gnutls/lib/ext/etm.c	1
/src/gnutls/lib/ext/heartbeat.c	1
/src/wget2/libwget/tls_session.c	6
/src/gnutls/lib/system_override.c	1
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/ext/alpn.c	2
/src/gnutls/lib/srp.c	1
/src/gnutls/lib/psk.c	2
/src/wget2/libwget/hpkp.c	7
/src/wget2/libwget/base64.c	4
/src/wget2/libwget/stringmap.c	2
/src/wget2/libwget/cookie_parse.c	4
/src/wget2/libwget/decompressor.c	7
/src/wget2/lib/./strtol.c	1
/src/gnutls/lib/cert-cred-x509.c	16
/src/gnutls/lib/system/certs.c	2
/src/gnutls/lib/x509/verify-high2.c	2
/src/gnutls/gl/read-file.c	2
/src/gnutls/gl/memset_explicit.c	1
/src/gnutls/lib/urls.c	3
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/gnutls/lib/unistring/unistr/u8-to-u16.c	1
/src/gnutls/lib/unistring/unistr/u16-uctomb.c	1
/src/gnutls/lib/unistring/unistr/u16-mbtouc-unsafe.c	1
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/str-unicode.c	3
/src/gnutls/lib/unistring/unistr/u8-check.c	1
/src/gnutls/lib/unistring/unictype/categ_or.c	1
/src/gnutls/lib/unistring/unictype/categ_and_not.c	1
/src/gnutls/lib/unistring/unictype/pr_default_ignorable_code_point.c	1
/src/gnutls/lib/unistring/unictype/pr_not_a_character.c	1
/src/gnutls/lib/unistring/unictype/pr_join_control.c	1
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/priority_options.gperf	2
/src/wget2/lib/fcntl.c	3