Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
arm_cpuinfo /src/boringssl/fuzz/arm_cpuinfo.cc 22 0 6 3 85 43 arm_cpuinfo.cc
der_roundtrip /src/boringssl/fuzz/der_roundtrip.cc 97 1980 9 17 816 386 der_roundtrip.cc
pkcs8 /src/boringssl/fuzz/pkcs8.cc 74 2013 8 13 654 328 pkcs8.cc
privkey /src/boringssl/fuzz/privkey.cc 533 1554 19 64 5109 2431 privkey.cc
pkcs8_lpm /src/fuzz_pkcs8.cc 202 2350 10 27 918 530 fuzz_pkcs8.cc
read_pem /src/boringssl/fuzz/read_pem.cc 57 2159 8 16 443 225 read_pem.cc
bn_div /src/boringssl/fuzz/bn_div.cc 106 1970 8 19 1019 516 bn_div.cc
spki /src/boringssl/fuzz/spki.cc 71 2016 8 13 610 308 spki.cc
bn_mod_exp /src/boringssl/fuzz/bn_mod_exp.cc 200 1880 11 24 2236 1053 bn_mod_exp.cc
pkcs12_lpm /src/fuzz_pkcs12.cc 411 3523 16 56 4000 1816 fuzz_pkcs12.cc
cert /src/boringssl/fuzz/cert.cc 443 3041 18 86 5576 2454 cert.cc
pkcs12 /src/boringssl/fuzz/pkcs12.cc 291 3189 15 43 3758 1644 pkcs12.cc
conf /src/boringssl/fuzz/conf.cc 391 3102 19 70 5156 2239 conf.cc
certs_lpm /src/fuzz_certs.cc 380 3548 19 62 3566 1615 fuzz_certs.cc
session /src/boringssl/fuzz/session.cc 196 5825 12 29 1749 1053 session.cc
decode_client_hello_inner /src/boringssl/fuzz/decode_client_hello_inner.cc 348 5759 11 39 1867 1073 decode_client_hello_inner.cc
server /src/boringssl/fuzz/server.cc 1943 4626 24 125 16509 8277 server.cc
dtls_server /src/boringssl/fuzz/dtls_server.cc 1943 4626 24 125 16509 8277 dtls_server.cc
dtls_client /src/boringssl/fuzz/dtls_client.cc 1943 4626 24 125 16509 8277 dtls_client.cc
client /src/boringssl/fuzz/client.cc 1943 4626 24 125 16509 8277 client.cc
ssl_ctx_api /src/boringssl/fuzz/ssl_ctx_api.cc 280 5873 10 31 1290 729 ssl_ctx_api.cc

Fuzzer details

Fuzzer: arm_cpuinfo

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 12 60.0%
gold [1:9] 7 35.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 5.0%
All colors 20 100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
12 7 extract_cpuinfo_field(STRING_PIECE*, STRING_PIECE const*, char const*) call site: 00007 strlen

Runtime coverage analysis

Covered functions
6
Functions that are reachable but not covered
11
Reachable functions
22
Percentage of reachable functions covered
50.0%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/arm_cpuinfo.cc 1
/src/boringssl/fuzz/../crypto/cpu_arm_linux.h 7
/src/boringssl/fuzz/../crypto/internal.h 2

Fuzzer: der_roundtrip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 30 15.3%
gold [1:9] 9 4.61%
yellow [10:29] 1 0.51%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 155 79.4%
All colors 195 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
2 2 1 :

['OPENSSL_memory_get_size']

2 85 OPENSSL_realloc call site: 00067 /src/boringssl/crypto/mem.c:306
2 2 1 :

['OPENSSL_memory_alloc']

2 60 OPENSSL_malloc call site: 00030 /src/boringssl/crypto/mem.c:233
2 2 1 :

['__errno_location']

2 6 ERR_put_error call site: 00035 /src/boringssl/crypto/err/err.c:665
2 2 1 :

['OPENSSL_memory_free']

2 2 OPENSSL_free call site: 00070 /src/boringssl/crypto/mem.c:276
2 2 1 :

['sdallocx']

2 2 OPENSSL_free call site: 00072 /src/boringssl/crypto/mem.c:292
0 73 1 :

['BN_new']

0 195 BN_bin2bn call site: 00142 /src/boringssl/crypto/fipsmodule/bn/bytes.c:90
0 18 1 :

['BN_free']

0 18 BN_bin2bn call site: 00143 /src/boringssl/crypto/fipsmodule/bn/bytes.c:104
0 0 None 24 26 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:176
0 0 None 24 26 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:209
0 0 None 24 26 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:215
0 0 None 24 24 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:254

Runtime coverage analysis

Covered functions
83
Functions that are reachable but not covered
18
Reachable functions
97
Percentage of reachable functions covered
81.44%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/der_roundtrip.cc 1
/src/boringssl/crypto/bytestring/cbs.c 16
/src/boringssl/include/openssl/base.h 3
/src/boringssl/crypto/bytestring/cbb.c 18
/src/boringssl/crypto/bytestring/../internal.h 3
/src/boringssl/crypto/mem.c 4
/src/boringssl/crypto/err/err.c 4
/src/boringssl/crypto/thread_pthread.c 3
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 1
/src/boringssl/crypto/ecdsa_extra/ecdsa_asn1.c 4
/src/boringssl/crypto/fipsmodule/ecdsa/ecdsa.c 2
/src/boringssl/crypto/fipsmodule/bn/bn.c 7
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 4
/src/boringssl/crypto/bn_extra/bn_asn1.c 2
/src/boringssl/crypto/fipsmodule/bn/bytes.c 5
/src/boringssl/crypto/bn_extra/convert.c 1

Fuzzer: pkcs8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 28 22.0%
gold [1:9] 9 7.08%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 90 70.8%
All colors 127 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
140 356 2 :

['bn_mod_lshift1_consttime', 'BN_sub_word']

140 3069 BN_mod_sqrt call site: 00000 /src/boringssl/crypto/fipsmodule/bn/sqrt.c:155
95 101 3 :

['BN_one', 'BN_zero', 'BN_abs_is_word']

95 101 BN_mod_exp_mont call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:604
95 101 3 :

['BN_one', 'BN_zero', 'BN_abs_is_word']

95 101 BN_mod_exp_mont_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:910
84 176 4 :

['bn_from_montgomery_in_place', 'bn_mul_small', 'OPENSSL_cleanse', 'bn_sqr_small']

86 178 bn_mod_mul_montgomery_small call site: 00000 /src/boringssl/crypto/fipsmodule/bn/montgomery.c:486
70 128 2 :

['ERR_add_error_dataf', 'ERR_put_error']

70 128 EVP_PKEY_set_type call site: 00071 /src/boringssl/crypto/evp/evp.c:343
63 237 2 :

['bn_sqr_recursive', 'bn_wexpand']

63 369 bn_sqr_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:694
32 32 3 :

['CRYPTO_atomic_load_u32.2804', 'CRYPTO_get_ex_data', 'sk_void_free']

32 32 CRYPTO_free_ex_data call site: 00000 /src/boringssl/crypto/ex_data.c:212
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
4 74 2 :

['OPENSSL_malloc', 'align_pointer']

42 3160 BN_mod_exp_mont_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:989
2 2 1 :

['bn_sqr_comba8']

2 100 bn_sqr_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:691
2 2 1 :

['OPENSSL_memory_get_size']

2 85 OPENSSL_realloc call site: 00111 /src/boringssl/crypto/mem.c:306
2 2 1 :

['OPENSSL_memory_alloc']

2 60 OPENSSL_malloc call site: 00063 /src/boringssl/crypto/mem.c:233

Runtime coverage analysis

Covered functions
474
Functions that are reachable but not covered
20
Reachable functions
74
Percentage of reachable functions covered
72.97%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/pkcs8.cc 1
/src/boringssl/crypto/bytestring/cbs.c 17
/src/boringssl/crypto/evp/evp_asn1.c 3
/src/boringssl/crypto/err/err.c 7
/src/boringssl/crypto/thread_pthread.c 3
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 3
/src/boringssl/crypto/evp/../internal.h 2
/src/boringssl/crypto/evp/evp.c 5
/src/boringssl/crypto/mem.c 5
/src/boringssl/crypto/refcount.c 1
/src/boringssl/crypto/bytestring/cbb.c 9
/src/boringssl/crypto/bytestring/../internal.h 2

Fuzzer: privkey

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 574 37.5%
gold [1:9] 90 5.89%
yellow [10:29] 16 1.04%
greenyellow [30:49] 8 0.52%
lawngreen 50+ 839 54.9%
All colors 1527 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
140 356 2 :

['bn_mod_lshift1_consttime', 'BN_sub_word']

140 3069 BN_mod_sqrt call site: 00731 /src/boringssl/crypto/fipsmodule/bn/sqrt.c:155
95 101 3 :

['BN_one', 'BN_zero', 'BN_abs_is_word']

95 101 BN_mod_exp_mont call site: 00739 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:604
95 101 3 :

['BN_one', 'BN_zero', 'BN_abs_is_word']

95 101 BN_mod_exp_mont_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:910
84 176 4 :

['bn_from_montgomery_in_place', 'bn_mul_small', 'OPENSSL_cleanse', 'bn_sqr_small']

86 178 bn_mod_mul_montgomery_small call site: 00000 /src/boringssl/crypto/fipsmodule/bn/montgomery.c:486
70 128 2 :

['ERR_add_error_dataf', 'ERR_put_error']

70 128 EVP_PKEY_set_type call site: 00073 /src/boringssl/crypto/evp/evp.c:343
63 237 2 :

['bn_sqr_recursive', 'bn_wexpand']

63 369 bn_sqr_consttime call site: 00553 /src/boringssl/crypto/fipsmodule/bn/mul.c:694
38 40 6 :

['bn_mul_mont_gather5', 'OPENSSL_memcpy', 'bn_gather5', 'bn_power5', 'bn_mul_mont', 'bn_scatter5']

38 305 BN_mod_exp_mont_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:1039
32 32 3 :

['CRYPTO_atomic_load_u32.2804', 'CRYPTO_get_ex_data', 'sk_void_free']

32 32 CRYPTO_free_ex_data call site: 00454 /src/boringssl/crypto/ex_data.c:212
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
4 74 2 :

['OPENSSL_malloc', 'align_pointer']

42 3160 BN_mod_exp_mont_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:989
2 2 1 :

['bn_sqr_comba8']

2 100 bn_sqr_consttime call site: 00552 /src/boringssl/crypto/fipsmodule/bn/mul.c:691
2 2 1 :

['OPENSSL_memory_get_size']

2 85 OPENSSL_realloc call site: 00246 /src/boringssl/crypto/mem.c:306

Runtime coverage analysis

Covered functions
431
Functions that are reachable but not covered
195
Reachable functions
533
Percentage of reachable functions covered
63.41%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/privkey.cc 1
/src/boringssl/crypto/evp/evp_asn1.c 6
/src/boringssl/crypto/err/err.c 9
/src/boringssl/crypto/thread_pthread.c 9
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 3
/src/boringssl/crypto/bytestring/cbs.c 20
/src/boringssl/crypto/evp/../internal.h 2
/src/boringssl/crypto/evp/evp.c 9
/src/boringssl/crypto/mem.c 6
/src/boringssl/crypto/refcount.c 2
/src/boringssl/crypto/ec_extra/ec_asn1.c 5
/src/boringssl/crypto/fipsmodule/ec/ec.c 20
/src/boringssl/crypto/ec_extra/../internal.h 1
/src/boringssl/crypto/fipsmodule/bn/ctx.c 15
/src/boringssl/crypto/fipsmodule/bn/bytes.c 5
/src/boringssl/crypto/fipsmodule/bn/bn.c 22
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 24
/src/boringssl/crypto/fipsmodule/ec/felem.c 8
/src/boringssl/crypto/fipsmodule/bn/div.c 16
/src/boringssl/crypto/fipsmodule/bn/asm/x86_64-gcc.c 8
/src/boringssl/crypto/fipsmodule/bn/montgomery.c 12
/src/boringssl/crypto/fipsmodule/bn/cmp.c 8
/src/boringssl/crypto/fipsmodule/bn/montgomery_inv.c 3
/src/boringssl/crypto/fipsmodule/bn/shift.c 8
/src/boringssl/crypto/stack/stack.c 3
/src/boringssl/crypto/stack/../internal.h 1
/src/boringssl/crypto/fipsmodule/bn/add.c 7
/src/boringssl/crypto/fipsmodule/ec/simple.c 7
/src/boringssl/crypto/fipsmodule/ec/ec_key.c 8
/src/boringssl/crypto/engine/engine.c 4
/src/boringssl/crypto/ex_data.c 3
/src/boringssl/include/openssl/stack.h 3
/src/boringssl/crypto/fipsmodule/ec/scalar.c 2
/src/boringssl/crypto/fipsmodule/ec/oct.c 4
/src/boringssl/crypto/fipsmodule/bn/mul.c 13
/src/boringssl/crypto/fipsmodule/bn/sqrt.c 1
/src/boringssl/crypto/fipsmodule/bn/exponentiation.c 2
/src/boringssl/crypto/fipsmodule/bn/random.c 2
/src/boringssl/crypto/fipsmodule/rand/rand.c 4
/src/boringssl/crypto/fipsmodule/rand/fork_detect.c 2
/src/boringssl/crypto/rand_extra/forkunsafe.c 1
/src/boringssl/crypto/rand_extra/../internal.h 1
/src/boringssl/crypto/fipsmodule/self_check/../rand/internal.h 2
/src/boringssl/crypto/rand_extra/deterministic.c 2
/src/boringssl/crypto/rand_extra/../fipsmodule/rand/../modes/../../internal.h 2
/src/boringssl/crypto/chacha/chacha.c 1
/src/boringssl/crypto/chacha/../internal.h 3
/src/boringssl/crypto/fipsmodule/rand/ctrdrbg.c 6
/src/boringssl/crypto/fipsmodule/cipher/e_aes.c 1
/src/boringssl/crypto/fipsmodule/cipher/../aes/internal.h 2
/src/boringssl/crypto/fipsmodule/modes/gcm.c 5
/src/boringssl/crypto/fipsmodule/modes/gcm_nohw.c 5
/src/boringssl/crypto/fipsmodule/aes/aes_nohw.c 26
/src/boringssl/crypto/fipsmodule/bn/jacobi.c 1
/src/boringssl/crypto/fipsmodule/../../include/openssl/err.h 2
/src/boringssl/crypto/dsa/dsa_asn1.c 3
/src/boringssl/crypto/dsa/dsa.c 2
/src/boringssl/crypto/dsa/../internal.h 1
/src/boringssl/crypto/bn_extra/bn_asn1.c 1
/src/boringssl/crypto/rsa_extra/rsa_asn1.c 2
/src/boringssl/crypto/fipsmodule/rsa/rsa.c 6
/src/boringssl/crypto/fipsmodule/rsa/rsa_impl.c 4
/src/boringssl/crypto/fipsmodule/rsa/blinding.c 1

Fuzzer: pkcs8_lpm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 39 16.2%
gold [1:9] 9 3.75%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 192 80.0%
All colors 240 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
140 356 2 :

['bn_mod_lshift1_consttime', 'BN_sub_word']

140 3069 BN_mod_sqrt call site: 00000 /src/boringssl/crypto/fipsmodule/bn/sqrt.c:155
95 101 3 :

['BN_one', 'BN_zero', 'BN_abs_is_word']

95 101 BN_mod_exp_mont call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:604
95 101 3 :

['BN_one', 'BN_zero', 'BN_abs_is_word']

95 101 BN_mod_exp_mont_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:910
84 176 4 :

['bn_from_montgomery_in_place', 'bn_mul_small', 'OPENSSL_cleanse', 'bn_sqr_small']

86 178 bn_mod_mul_montgomery_small call site: 00000 /src/boringssl/crypto/fipsmodule/bn/montgomery.c:486
70 128 2 :

['ERR_add_error_dataf', 'ERR_put_error']

70 128 EVP_PKEY_set_type call site: 00134 /src/boringssl/crypto/evp/evp.c:343
63 237 2 :

['bn_sqr_recursive', 'bn_wexpand']

63 369 bn_sqr_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:694
32 32 3 :

['CRYPTO_atomic_load_u32.2804', 'CRYPTO_get_ex_data', 'sk_void_free']

32 32 CRYPTO_free_ex_data call site: 00000 /src/boringssl/crypto/ex_data.c:212
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
12 17 2 :

['asn1_pdu::Length::_internal_set_indefinite_form(bool)', 'asn1_pdu::Length::_internal_indefinite_form() const']

20 25 asn1_pdu::Length::MergeImpl(google::protobuf::Message&,google::protobuf::Messageconst&) call site: 00000 /work/boringssl/genfiles/asn1_pdu.pb.cc:1476
9 35 7 :

['asn1_pdu::Length::clear_types()', 'google::protobuf::internal::ArenaStringPtr::InitDefault()', 'asn1_pdu::Length::types_case() const', 'asn1_pdu::Length::set_has_length_override()', 'void google::protobuf::internal::ArenaStringPtr::Set<>(std::__1::basic_string , std::__1::allocator > const&, google::protobuf::Arena*)', 'asn1_pdu::Length::_internal_length_override() const', 'google::protobuf::MessageLite::GetArenaForAllocation() const']

17 43 asn1_pdu::Length::MergeImpl(google::protobuf::Message&,google::protobuf::Messageconst&) call site: 00000 /work/boringssl/genfiles/asn1_pdu.pb.cc:1476
8 8 1 :

['google::protobuf::internal::RepeatedPtrFieldBase::MergeFromInternal(google::protobuf::internal::RepeatedPtrFieldBase const&, void (google::protobuf::internal::RepeatedPtrFieldBase::*)(void**, void**, int, int))']

8 8 voidgoogle::protobuf::internal::RepeatedPtrFieldBase::MergeFrom ::TypeHandler>(google::protobuf::internal::RepeatedPtrFieldBaseconst&) call site: 00000 /src/LPM/external.protobuf/include/google/protobuf/repeated_ptr_field.h:300
2 2 1 :

['bn_sqr_comba8']

2 100 bn_sqr_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:691

Runtime coverage analysis

Covered functions
632
Functions that are reachable but not covered
35
Reachable functions
202
Percentage of reachable functions covered
82.67%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/fuzz_pkcs8.cc 2
/work/boringssl/genfiles/asn1_pdu.pb.h 27
/work/boringssl/genfiles/asn1_pdu.pb.cc 13
/src/LPM/external.protobuf/include/google/protobuf/message.h 1
/src/LPM/external.protobuf/include/google/protobuf/message_lite.h 3
/src/LPM/external.protobuf/include/google/protobuf/metadata_lite.h 6
/src/LPM/external.protobuf/include/google/protobuf/generated_message_util.h 1
/src/asn1_pdu_to_der.h 2
/src/asn1_pdu_to_der.cc 9
/src/common.cc 3
/usr/local/bin/../include/c++/v1/math.h 1
/src/LPM/external.protobuf/include/google/protobuf/repeated_ptr_field.h 5
/src/LPM/external.protobuf/include/google/protobuf/explicitly_constructed.h 1
/src/LPM/external.protobuf/include/google/protobuf/arenastring.h 2
/src/boringssl/crypto/bytestring/cbs.c 17
/src/boringssl/crypto/evp/evp_asn1.c 3
/src/boringssl/crypto/err/err.c 7
/src/boringssl/crypto/thread_pthread.c 3
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 3
/src/boringssl/crypto/evp/../internal.h 2
/src/boringssl/crypto/evp/evp.c 5
/src/boringssl/crypto/mem.c 5
/src/boringssl/crypto/refcount.c 1
/src/boringssl/include/openssl/base.h 3
/src/boringssl/crypto/bytestring/cbb.c 9
/src/boringssl/crypto/bytestring/../internal.h 2

Fuzzer: read_pem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 20 16.6%
gold [1:9] 9 7.5%
yellow [10:29] 0 0.0%
greenyellow [30:49] 1 0.83%
lawngreen 50+ 90 75.0%
All colors 120 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
2 2 1 :

['OPENSSL_memory_get_size']

2 85 OPENSSL_realloc call site: 00057 /src/boringssl/crypto/mem.c:306
2 2 1 :

['OPENSSL_memory_alloc']

2 60 OPENSSL_malloc call site: 00024 /src/boringssl/crypto/mem.c:233
2 2 1 :

['__errno_location']

2 6 ERR_put_error call site: 00004 /src/boringssl/crypto/err/err.c:665
2 2 1 :

['OPENSSL_memory_free']

2 2 OPENSSL_free call site: 00030 /src/boringssl/crypto/mem.c:276
2 2 1 :

['sdallocx']

2 2 OPENSSL_free call site: 00032 /src/boringssl/crypto/mem.c:292
0 58 1 :

['ERR_put_error']

0 58 BIO_gets call site: 00046 /src/boringssl/crypto/bio/bio.c:147
0 0 None 24 26 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:176
0 0 None 24 26 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:209
0 0 None 24 26 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:215
0 0 None 24 24 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:254
0 0 None 4 4 mem_read call site: 00000 /src/boringssl/crypto/bio/bio_mem.c:140

Runtime coverage analysis

Covered functions
54
Functions that are reachable but not covered
17
Reachable functions
57
Percentage of reachable functions covered
70.18%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/read_pem.cc 1
/src/boringssl/crypto/bio/bio_mem.c 1
/src/boringssl/crypto/err/err.c 5
/src/boringssl/crypto/thread_pthread.c 3
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 3
/src/boringssl/crypto/bio/bio.c 4
/src/boringssl/crypto/mem.c 4
/src/boringssl/crypto/bio/../internal.h 1
/src/boringssl/crypto/pem/pem_lib.c 1
/src/boringssl/crypto/buf/buf.c 5
/src/boringssl/crypto/buf/../internal.h 1
/src/boringssl/crypto/pem/../internal.h 1
/src/boringssl/crypto/base64/base64.c 7
/src/boringssl/crypto/base64/../internal.h 5
/src/boringssl/crypto/refcount.c 1

Fuzzer: bn_div

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 54 20.8%
gold [1:9] 2 0.77%
yellow [10:29] 0 0.0%
greenyellow [30:49] 3 1.15%
lawngreen 50+ 200 77.2%
All colors 259 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
58 58 1 :

['ERR_put_error']

58 58 BN_lshift call site: 00114 /src/boringssl/crypto/fipsmodule/bn/shift.c:72
58 58 1 :

['ERR_put_error']

58 58 BN_rshift call site: 00132 /src/boringssl/crypto/fipsmodule/bn/shift.c:157
58 58 1 :

['ERR_put_error']

58 58 sk_insert call site: 00000 /src/boringssl/crypto/stack/stack.c:166
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
2 15 2 :

['OPENSSL_memory_get_size', 'OPENSSL_free']

2 85 OPENSSL_realloc call site: 00086 /src/boringssl/crypto/mem.c:301
2 2 1 :

['OPENSSL_memory_alloc']

60 60 OPENSSL_malloc call site: 00018 /src/boringssl/crypto/mem.c:233
2 2 1 :

['OPENSSL_memory_free']

2 2 OPENSSL_free call site: 00048 /src/boringssl/crypto/mem.c:276
2 2 1 :

['sdallocx']

2 2 OPENSSL_free call site: 00050 /src/boringssl/crypto/mem.c:292
0 144 1 :

['BN_CTX_get']

0 868 BN_div call site: 00109 /src/boringssl/crypto/fipsmodule/bn/div.c:226
0 18 1 :

['BN_free']

0 18 BN_bin2bn call site: 00043 /src/boringssl/crypto/fipsmodule/bn/bytes.c:104
0 4 1 :

['bn_mul_comba8']

0 57 bn_mul_part_recursive call site: 00189 /src/boringssl/crypto/fipsmodule/bn/mul.c:346
0 3 1 :

['bn_fits_in_words']

116 209 bn_usub_consttime call site: 00242 /src/boringssl/crypto/fipsmodule/bn/add.c:230

Runtime coverage analysis

Covered functions
100
Functions that are reachable but not covered
23
Reachable functions
106
Percentage of reachable functions covered
78.3%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/bn_div.cc 1
/src/boringssl/crypto/bytestring/cbs.c 9
/src/boringssl/crypto/fipsmodule/bn/bytes.c 2
/src/boringssl/crypto/fipsmodule/bn/bn.c 12
/src/boringssl/crypto/mem.c 4
/src/boringssl/crypto/err/err.c 4
/src/boringssl/crypto/thread_pthread.c 3
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 1
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 11
/src/boringssl/crypto/fipsmodule/bn/cmp.c 4
/src/boringssl/crypto/fipsmodule/bn/ctx.c 11
/src/boringssl/crypto/fipsmodule/bn/div.c 2
/src/boringssl/crypto/stack/stack.c 2
/src/boringssl/crypto/stack/../internal.h 1
/src/boringssl/crypto/fipsmodule/bn/shift.c 3
/src/boringssl/crypto/fipsmodule/bn/asm/x86_64-gcc.c 5
/src/boringssl/crypto/fipsmodule/bn/mul.c 7
/src/boringssl/crypto/fipsmodule/bn/add.c 5

Fuzzer: spki

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 28 22.7%
gold [1:9] 9 7.31%
yellow [10:29] 1 0.81%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 85 69.1%
All colors 123 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
1574 3276 14 :

['bn_div_consttime', 'bn_usub_consttime', 'BN_free', 'ERR_put_error', 'BN_num_bits', 'BN_init', 'BN_CTX_new', 'BN_cmp', 'BN_is_one', 'BN_value_one', 'bn_mul_consttime', 'BN_is_negative', 'BN_CTX_free', 'check_mod_inverse']

1574 3276 RSA_check_key call site: 00000 /src/boringssl/crypto/fipsmodule/rsa/rsa.c:816
185 331 4 :

['bn_mul_part_recursive', 'BN_num_bits_word', 'BN_CTX_get', 'bn_mul_recursive']

185 891 bn_mul_impl call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:455
140 356 2 :

['bn_mod_lshift1_consttime', 'BN_sub_word']

140 3069 BN_mod_sqrt call site: 00000 /src/boringssl/crypto/fipsmodule/bn/sqrt.c:155
95 101 3 :

['BN_one', 'BN_zero', 'BN_abs_is_word']

95 101 BN_mod_exp_mont call site: 00000 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:604
84 176 4 :

['bn_from_montgomery_in_place', 'bn_mul_small', 'OPENSSL_cleanse', 'bn_sqr_small']

86 178 bn_mod_mul_montgomery_small call site: 00000 /src/boringssl/crypto/fipsmodule/bn/montgomery.c:486
70 128 2 :

['ERR_add_error_dataf', 'ERR_put_error']

70 128 EVP_PKEY_set_type call site: 00066 /src/boringssl/crypto/evp/evp.c:343
63 237 2 :

['bn_sqr_recursive', 'bn_wexpand']

63 369 bn_sqr_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:694
32 32 3 :

['CRYPTO_atomic_load_u32.2804', 'CRYPTO_get_ex_data', 'sk_void_free']

32 32 CRYPTO_free_ex_data call site: 00000 /src/boringssl/crypto/ex_data.c:212
28 106 3 :

['ec_felem_equal', 'BN_cmp', 'ec_GFp_simple_points_equal']

28 106 EC_GROUP_cmp call site: 00000 /src/boringssl/crypto/fipsmodule/ec/ec.c:587
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
2 2 1 :

['bn_mul_comba8']

2 187 bn_mul_impl call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:443
2 2 1 :

['bn_sqr_comba8']

2 100 bn_sqr_consttime call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:691

Runtime coverage analysis

Covered functions
359
Functions that are reachable but not covered
20
Reachable functions
71
Percentage of reachable functions covered
71.83%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/spki.cc 1
/src/boringssl/crypto/bytestring/cbs.c 14
/src/boringssl/crypto/evp/evp_asn1.c 3
/src/boringssl/crypto/err/err.c 7
/src/boringssl/crypto/thread_pthread.c 3
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 3
/src/boringssl/crypto/evp/../internal.h 2
/src/boringssl/crypto/evp/evp.c 5
/src/boringssl/crypto/mem.c 5
/src/boringssl/crypto/refcount.c 1
/src/boringssl/crypto/bytestring/cbb.c 9
/src/boringssl/crypto/bytestring/../internal.h 2

Fuzzer: bn_mod_exp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 127 19.0%
gold [1:9] 3 0.45%
yellow [10:29] 3 0.45%
greenyellow [30:49] 1 0.15%
lawngreen 50+ 531 79.8%
All colors 665 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
58 61 2 :

['ERR_put_error', 'bn_fits_in_words']

58 65 bn_copy_words call site: 00630 /src/boringssl/crypto/fipsmodule/bn/bn.c:322
58 58 1 :

['ERR_put_error']

58 58 bn_resize_words call site: 00337 /src/boringssl/crypto/fipsmodule/bn/bn.c:398
58 58 1 :

['ERR_put_error']

58 58 BN_mod_exp_mont call site: 00273 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:598
58 58 1 :

['ERR_put_error']

58 58 BN_mod_exp_mont_consttime call site: 00545 /src/boringssl/crypto/fipsmodule/bn/exponentiation.c:901
58 58 1 :

['ERR_put_error']

58 58 bn_mont_ctx_set_N_and_n0 call site: 00298 /src/boringssl/crypto/fipsmodule/bn/montgomery.c:181
58 58 1 :

['ERR_put_error']

58 58 BN_lshift call site: 00135 /src/boringssl/crypto/fipsmodule/bn/shift.c:72
58 58 1 :

['ERR_put_error']

58 58 BN_rshift call site: 00152 /src/boringssl/crypto/fipsmodule/bn/shift.c:157
58 58 1 :

['ERR_put_error']

58 58 sk_insert call site: 00000 /src/boringssl/crypto/stack/stack.c:166
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
2 2 1 :

['OPENSSL_memory_alloc']

60 60 OPENSSL_malloc call site: 00022 /src/boringssl/crypto/mem.c:233
2 2 1 :

['OPENSSL_memory_get_size']

2 85 OPENSSL_realloc call site: 00108 /src/boringssl/crypto/mem.c:306
2 2 1 :

['OPENSSL_memory_free']

2 2 OPENSSL_free call site: 00052 /src/boringssl/crypto/mem.c:276

Runtime coverage analysis

Covered functions
177
Functions that are reachable but not covered
37
Reachable functions
200
Percentage of reachable functions covered
81.5%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/bn_mod_exp.cc 2
/src/boringssl/crypto/bytestring/cbs.c 9
/src/boringssl/crypto/fipsmodule/bn/bytes.c 5
/src/boringssl/crypto/fipsmodule/bn/bn.c 20
/src/boringssl/crypto/mem.c 4
/src/boringssl/crypto/err/err.c 4
/src/boringssl/crypto/thread_pthread.c 3
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 1
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 18
/src/boringssl/crypto/fipsmodule/bn/cmp.c 7
/src/boringssl/crypto/fipsmodule/bn/ctx.c 15
/src/boringssl/crypto/fipsmodule/bn/div.c 11
/src/boringssl/crypto/stack/stack.c 2
/src/boringssl/crypto/stack/../internal.h 1
/src/boringssl/crypto/fipsmodule/bn/shift.c 8
/src/boringssl/crypto/fipsmodule/bn/asm/x86_64-gcc.c 8
/src/boringssl/crypto/fipsmodule/bn/mul.c 13
/src/boringssl/crypto/fipsmodule/bn/exponentiation.c 13
/src/boringssl/crypto/fipsmodule/bn/montgomery.c 13
/src/boringssl/crypto/fipsmodule/bn/montgomery_inv.c 3
/src/boringssl/crypto/fipsmodule/bn/add.c 4
/src/boringssl/crypto/fipsmodule/bn/rsaz_exp.h 1
/src/boringssl/crypto/fipsmodule/bn/rsaz_exp.c 1

Fuzzer: pkcs12_lpm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 247 50.1%
gold [1:9] 13 2.63%
yellow [10:29] 1 0.20%
greenyellow [30:49] 2 0.40%
lawngreen 50+ 230 46.6%
All colors 493 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
1085 1460 8 :

['CBS_get_asn1', 'PKCS12_handle_sequence', 'CBS_get_asn1_uint64', 'strlen', 'pkcs12_iterations_acceptable', 'CBS_len', 'pkcs12_check_mac', 'EVP_parse_digest_algorithm']

1417 2135 PKCS12_get_key_and_certs call site: 00223 /src/boringssl/crypto/pkcs8/pkcs8_x509.c:644
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
15 28 3 :

['CRYPTO_refcount_dec_and_test_zero', 'free_it', 'OPENSSL_free']

15 28 EVP_PKEY_free call site: 00352 /src/boringssl/crypto/evp/evp.c:107
12 17 2 :

['asn1_pdu::Length::_internal_set_indefinite_form(bool)', 'asn1_pdu::Length::_internal_indefinite_form() const']

20 25 asn1_pdu::Length::MergeImpl(google::protobuf::Message&,google::protobuf::Messageconst&) call site: 00000 /work/boringssl/genfiles/asn1_pdu.pb.cc:1476
9 35 7 :

['asn1_pdu::Length::clear_types()', 'google::protobuf::internal::ArenaStringPtr::InitDefault()', 'asn1_pdu::Length::types_case() const', 'asn1_pdu::Length::set_has_length_override()', 'void google::protobuf::internal::ArenaStringPtr::Set<>(std::__1::basic_string , std::__1::allocator > const&, google::protobuf::Arena*)', 'asn1_pdu::Length::_internal_length_override() const', 'google::protobuf::MessageLite::GetArenaForAllocation() const']

17 43 asn1_pdu::Length::MergeImpl(google::protobuf::Message&,google::protobuf::Messageconst&) call site: 00000 /work/boringssl/genfiles/asn1_pdu.pb.cc:1476
8 8 1 :

['google::protobuf::internal::RepeatedPtrFieldBase::MergeFromInternal(google::protobuf::internal::RepeatedPtrFieldBase const&, void (google::protobuf::internal::RepeatedPtrFieldBase::*)(void**, void**, int, int))']

8 8 voidgoogle::protobuf::internal::RepeatedPtrFieldBase::MergeFrom ::TypeHandler>(google::protobuf::internal::RepeatedPtrFieldBaseconst&) call site: 00000 /src/LPM/external.protobuf/include/google/protobuf/repeated_ptr_field.h:300
2 2 1 :

['OPENSSL_memory_get_size']

2 85 OPENSSL_realloc call site: 00155 /src/boringssl/crypto/mem.c:306
2 2 1 :

['OPENSSL_memory_alloc']

2 60 OPENSSL_malloc call site: 00067 /src/boringssl/crypto/mem.c:233
2 2 1 :

['__errno_location']

2 6 ERR_put_error call site: 00072 /src/boringssl/crypto/err/err.c:665
2 2 1 :

['OPENSSL_memory_free']

2 2 OPENSSL_free call site: 00094 /src/boringssl/crypto/mem.c:276
2 2 1 :

['sdallocx']

2 2 OPENSSL_free call site: 00096 /src/boringssl/crypto/mem.c:292
0 0 None 24 26 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:176

Runtime coverage analysis

Covered functions
244
Functions that are reachable but not covered
240
Reachable functions
411
Percentage of reachable functions covered
41.61%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/fuzz_pkcs12.cc 2
/work/boringssl/genfiles/asn1_pdu.pb.h 27
/work/boringssl/genfiles/asn1_pdu.pb.cc 13
/src/LPM/external.protobuf/include/google/protobuf/message.h 1
/src/LPM/external.protobuf/include/google/protobuf/message_lite.h 3
/src/LPM/external.protobuf/include/google/protobuf/metadata_lite.h 6
/src/LPM/external.protobuf/include/google/protobuf/generated_message_util.h 1
/src/asn1_pdu_to_der.h 2
/src/asn1_pdu_to_der.cc 9
/src/common.cc 3
/usr/local/bin/../include/c++/v1/math.h 1
/src/LPM/external.protobuf/include/google/protobuf/repeated_ptr_field.h 5
/src/LPM/external.protobuf/include/google/protobuf/explicitly_constructed.h 1
/src/LPM/external.protobuf/include/google/protobuf/arenastring.h 2
/src/boringssl/include/openssl/x509.h 3
/src/boringssl/crypto/stack/stack.c 4
/src/boringssl/crypto/mem.c 5
/src/boringssl/crypto/err/err.c 4
/src/boringssl/crypto/thread_pthread.c 6
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 3
/src/boringssl/crypto/stack/../internal.h 1
/src/boringssl/crypto/bytestring/cbs.c 19
/src/boringssl/crypto/pkcs8/pkcs8_x509.c 4
/src/boringssl/crypto/bytestring/ber.c 5
/src/boringssl/crypto/bytestring/cbb.c 17
/src/boringssl/crypto/bytestring/../internal.h 3
/src/boringssl/crypto/pkcs8/../internal.h 2
/src/boringssl/crypto/digest_extra/digest_extra.c 3
/src/boringssl/crypto/digest_extra/../internal.h 1
/src/boringssl/crypto/fipsmodule/digest/digest.c 8
/src/boringssl/crypto/pkcs8/pkcs8.c 2
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 2
/src/boringssl/crypto/bytestring/unicode.c 3
/src/boringssl/crypto/fipsmodule/hmac/hmac.c 6
/src/boringssl/crypto/evp/evp.c 2
/src/boringssl/crypto/refcount.c 1
/src/boringssl/crypto/x509/x_x509.c 2
/src/boringssl/crypto/ex_data.c 2
/src/boringssl/include/openssl/stack.h 3
/src/boringssl/crypto/asn1/tasn_fre.c 4
/src/boringssl/include/openssl/asn1t.h 3
/src/boringssl/crypto/asn1/a_object.c 1
/src/boringssl/crypto/asn1/a_type.c 1
/src/boringssl/crypto/asn1/asn1_lib.c 1
/src/boringssl/crypto/asn1/tasn_utl.c 7
/src/boringssl/crypto/pool/pool.c 2
/src/boringssl/crypto/pool/internal.h 3
/src/boringssl/crypto/lhash/lhash.c 2
/src/boringssl/crypto/x509/x_algor.c 1
/src/boringssl/crypto/asn1/tasn_typ.c 2
/src/boringssl/crypto/x509v3/v3_akeya.c 1
/src/boringssl/crypto/x509v3/v3_crld.c 1
/src/boringssl/crypto/x509v3/v3_genn.c 1
/src/boringssl/crypto/x509v3/v3_ncons.c 1
/src/boringssl/crypto/x509/x_x509a.c 1

Fuzzer: cert

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 309 25.6%
gold [1:9] 29 2.40%
yellow [10:29] 21 1.74%
greenyellow [30:49] 21 1.74%
lawngreen 50+ 826 68.4%
All colors 1206 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2160 3276 14 :

['bn_div_consttime', 'bn_usub_consttime', 'BN_free', 'ERR_put_error', 'BN_num_bits', 'BN_init', 'BN_CTX_new', 'BN_cmp', 'BN_is_one', 'BN_value_one', 'bn_mul_consttime', 'BN_is_negative', 'BN_CTX_free', 'check_mod_inverse']

2160 3276 RSA_check_key call site: 00000 /src/boringssl/crypto/fipsmodule/rsa/rsa.c:816
84 176 4 :

['bn_from_montgomery_in_place', 'bn_mul_small', 'OPENSSL_cleanse', 'bn_sqr_small']

86 178 bn_mod_mul_montgomery_small call site: 00000 /src/boringssl/crypto/fipsmodule/bn/montgomery.c:486
70 128 2 :

['ERR_add_error_dataf', 'ERR_put_error']

70 128 EVP_PKEY_set_type call site: 00614 /src/boringssl/crypto/evp/evp.c:343
70 70 1 :

['ERR_add_error_dataf']

70 128 ASN1_mbstring_ncopy call site: 00000 /src/boringssl/crypto/asn1/a_mbstr.c:173
40 40 2 :

['sk_X509V3_EXT_METHOD_value', 'sk_X509V3_EXT_METHOD_find']

40 40 X509V3_EXT_get_nid call site: 00741 /src/boringssl/crypto/x509v3/v3_lib.c:114
32 32 3 :

['CRYPTO_atomic_load_u32.2804', 'CRYPTO_get_ex_data', 'sk_void_free']

32 32 CRYPTO_free_ex_data call site: 00451 /src/boringssl/crypto/ex_data.c:212
28 106 3 :

['ec_felem_equal', 'BN_cmp', 'ec_GFp_simple_points_equal']

28 106 EC_GROUP_cmp call site: 00000 /src/boringssl/crypto/fipsmodule/ec/ec.c:587
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
16 34 3 :

['CRYPTO_STATIC_MUTEX_unlock_read', 'lh_ASN1_OBJECT_retrieve', 'CRYPTO_STATIC_MUTEX_lock_read']

16 92 OBJ_nid2obj call site: 00197 /src/boringssl/crypto/obj/obj.c:345
2 166 2 :

['bn_print', 'EC_KEY_get0_private_key']

2 640 do_EC_KEY_print call site: 00000 /src/boringssl/crypto/evp/print.c:270
2 2 1 :

['strlen']

166 1295 ASN1_mbstring_ncopy call site: 00000 /src/boringssl/crypto/asn1/a_mbstr.c:89
2 2 1 :

['DSA_get0_priv_key']

2 916 do_dsa_print call site: 00000 /src/boringssl/crypto/evp/print.c:196

Runtime coverage analysis

Covered functions
714
Functions that are reachable but not covered
81
Reachable functions
443
Percentage of reachable functions covered
81.72%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/cert.cc 1
/src/boringssl/crypto/x509/x_x509.c 7
/src/boringssl/crypto/err/err.c 11
/src/boringssl/crypto/thread_pthread.c 13
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 4
/src/boringssl/crypto/bytestring/cbs.c 27
/src/boringssl/crypto/mem.c 11
/src/boringssl/crypto/x509/../internal.h 2
/src/boringssl/crypto/ex_data.c 3
/src/boringssl/crypto/asn1/tasn_dec.c 10
/src/boringssl/crypto/pool/pool.c 4
/src/boringssl/crypto/asn1/asn1_lib.c 10
/src/boringssl/include/openssl/asn1t.h 6
/src/boringssl/crypto/stack/stack.c 6
/src/boringssl/crypto/stack/../internal.h 1
/src/boringssl/crypto/asn1/tasn_fre.c 4
/src/boringssl/crypto/asn1/a_object.c 7
/src/boringssl/crypto/asn1/a_type.c 2
/src/boringssl/crypto/asn1/tasn_utl.c 13
/src/boringssl/crypto/refcount.c 2
/src/boringssl/crypto/pool/internal.h 3
/src/boringssl/crypto/lhash/lhash.c 2
/src/boringssl/crypto/asn1/tasn_typ.c 9
/src/boringssl/crypto/asn1/tasn_new.c 7
/src/boringssl/crypto/obj/obj.c 10
/src/boringssl/crypto/asn1/../internal.h 5
/src/boringssl/crypto/obj/../internal.h 2
/src/boringssl/crypto/asn1/a_bitstr.c 3
/src/boringssl/crypto/asn1/a_int.c 11
/src/boringssl/crypto/bytestring/unicode.c 5
/src/boringssl/crypto/asn1/posix_time.c 6
/usr/include/x86_64-linux-gnu/bits/stdlib-bsearch.h 1
/src/boringssl/crypto/x509/x_algor.c 3
/src/boringssl/include/openssl/stack.h 3
/src/boringssl/crypto/x509v3/v3_akeya.c 1
/src/boringssl/crypto/x509v3/v3_crld.c 2
/src/boringssl/crypto/x509v3/v3_genn.c 1
/src/boringssl/crypto/x509v3/v3_ncons.c 1
/src/boringssl/crypto/x509/x_x509a.c 1
/src/boringssl/crypto/x509/x509_cmp.c 5
/src/boringssl/crypto/x509/x_pubkey.c 2
/src/boringssl/crypto/evp/evp.c 7
/src/boringssl/crypto/asn1/tasn_enc.c 8
/src/boringssl/crypto/evp/evp_asn1.c 2
/src/boringssl/crypto/evp/../internal.h 2
/src/boringssl/crypto/x509v3/v3_purp.c 6
/src/boringssl/crypto/fipsmodule/digest/digests.c 2
/src/boringssl/crypto/x509/x_all.c 1
/src/boringssl/crypto/bytestring/cbb.c 18
/src/boringssl/crypto/bytestring/../internal.h 3
/src/boringssl/crypto/bytestring/asn1_compat.c 1
/src/boringssl/crypto/fipsmodule/digest/digest.c 6
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 1
/src/boringssl/crypto/x509/x509_set.c 3
/src/boringssl/crypto/x509/x509_ext.c 3
/src/boringssl/crypto/x509v3/v3_lib.c 6
/src/boringssl/include/openssl/x509.h 5
/src/boringssl/crypto/x509/x509_v3.c 5
/src/boringssl/include/openssl/x509v3.h 7
/src/boringssl/crypto/x509v3/v3_bcons.c 1
/src/boringssl/include/openssl/asn1.h 4
/src/boringssl/crypto/asn1/a_octet.c 1
/src/boringssl/crypto/x509/x_name.c 6
/src/boringssl/crypto/asn1/a_dup.c 1
/src/boringssl/crypto/x509/x509name.c 5
/src/boringssl/crypto/bio/bio_mem.c 1
/src/boringssl/crypto/bio/bio.c 8
/src/boringssl/crypto/bio/../internal.h 1
/src/boringssl/crypto/x509/t_x509.c 4
/src/boringssl/crypto/bio/printf.c 1
/src/boringssl/crypto/x509/rsa_pss.c 5
/src/boringssl/crypto/asn1/f_int.c 1
/src/boringssl/crypto/x509/x509.c 1
/src/boringssl/crypto/x509/name_print.c 4
/src/boringssl/crypto/x509/x509_obj.c 1
/src/boringssl/crypto/buf/buf.c 4
/src/boringssl/crypto/buf/../internal.h 1
/src/boringssl/crypto/asn1/a_strex.c 12
/src/boringssl/crypto/asn1/asn1_par.c 1
/src/boringssl/crypto/evp/print.c 3
/src/boringssl/crypto/x509v3/v3_prn.c 4
/src/boringssl/crypto/bio/hexdump.c 4
/src/boringssl/include/openssl/conf.h 4
/src/boringssl/crypto/x509v3/v3_utl.c 1
/src/boringssl/crypto/x509/t_x509a.c 1

Fuzzer: pkcs12

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 71 18.3%
gold [1:9] 19 4.92%
yellow [10:29] 4 1.03%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 292 75.6%
All colors 386 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
172 176 4 :

['bn_from_montgomery_in_place', 'bn_mul_small', 'OPENSSL_cleanse', 'bn_sqr_small']

174 178 bn_mod_mul_montgomery_small call site: 00000 /src/boringssl/crypto/fipsmodule/bn/montgomery.c:486
70 128 2 :

['ERR_add_error_dataf', 'ERR_put_error']

70 128 EVP_PKEY_set_type call site: 00000 /src/boringssl/crypto/evp/evp.c:343
70 70 1 :

['ERR_add_error_dataf']

70 128 ASN1_mbstring_ncopy call site: 00000 /src/boringssl/crypto/asn1/a_mbstr.c:173
48 106 2 :

['OBJ_obj2nid', 'ERR_put_error']

48 106 asn1_do_adb call site: 00000 /src/boringssl/crypto/asn1/tasn_utl.c:219
38 66 3 :

['CBS_len', 'OPENSSL_gmtime_adj', 'cbs_get_two_digits']

38 66 CBS_parse_rfc5280_time_internal call site: 00000 /src/boringssl/crypto/bytestring/cbs.c:886
32 32 3 :

['CRYPTO_atomic_load_u32.2804', 'CRYPTO_get_ex_data', 'sk_void_free']

32 32 CRYPTO_free_ex_data call site: 00300 /src/boringssl/crypto/ex_data.c:212
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
18 18 1 :

['ASN1_UTF8STRING_free']

18 18 X509_alias_set1 call site: 00000 /src/boringssl/crypto/x509/x_x509a.c:98
16 34 3 :

['CRYPTO_STATIC_MUTEX_unlock_read', 'lh_ASN1_OBJECT_retrieve', 'CRYPTO_STATIC_MUTEX_lock_read']

16 92 OBJ_nid2obj call site: 00000 /src/boringssl/crypto/obj/obj.c:345
13 13 2 :

['sk_ASN1_VALUE_pop', 'sk_ASN1_VALUE_num.4928']

13 2036 asn1_template_noexp_d2i call site: 00000 /src/boringssl/crypto/asn1/tasn_dec.c:597
2 2 1 :

['strlen']

166 1295 ASN1_mbstring_ncopy call site: 00000 /src/boringssl/crypto/asn1/a_mbstr.c:89
2 2 1 :

['strlen']

2 219 ASN1_STRING_set call site: 00000 /src/boringssl/crypto/asn1/asn1_lib.c:267

Runtime coverage analysis

Covered functions
727
Functions that are reachable but not covered
64
Reachable functions
291
Percentage of reachable functions covered
78.01%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/pkcs12.cc 1
/src/boringssl/include/openssl/x509.h 3
/src/boringssl/crypto/stack/stack.c 4
/src/boringssl/crypto/mem.c 5
/src/boringssl/crypto/err/err.c 4
/src/boringssl/crypto/thread_pthread.c 6
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 3
/src/boringssl/crypto/stack/../internal.h 1
/src/boringssl/crypto/bytestring/cbs.c 19
/src/boringssl/crypto/pkcs8/pkcs8_x509.c 4
/src/boringssl/crypto/bytestring/ber.c 5
/src/boringssl/crypto/bytestring/cbb.c 17
/src/boringssl/crypto/bytestring/../internal.h 3
/src/boringssl/crypto/pkcs8/../internal.h 2
/src/boringssl/crypto/digest_extra/digest_extra.c 3
/src/boringssl/crypto/digest_extra/../internal.h 1
/src/boringssl/crypto/fipsmodule/digest/digest.c 8
/src/boringssl/crypto/pkcs8/pkcs8.c 2
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 2
/src/boringssl/crypto/bytestring/unicode.c 3
/src/boringssl/crypto/fipsmodule/hmac/hmac.c 6
/src/boringssl/crypto/evp/evp.c 2
/src/boringssl/crypto/refcount.c 1
/src/boringssl/crypto/x509/x_x509.c 2
/src/boringssl/crypto/ex_data.c 2
/src/boringssl/include/openssl/stack.h 3
/src/boringssl/crypto/asn1/tasn_fre.c 4
/src/boringssl/include/openssl/asn1t.h 3
/src/boringssl/crypto/asn1/a_object.c 1
/src/boringssl/crypto/asn1/a_type.c 1
/src/boringssl/crypto/asn1/asn1_lib.c 1
/src/boringssl/crypto/asn1/tasn_utl.c 7
/src/boringssl/crypto/pool/pool.c 2
/src/boringssl/crypto/pool/internal.h 3
/src/boringssl/crypto/lhash/lhash.c 2
/src/boringssl/crypto/x509/x_algor.c 1
/src/boringssl/crypto/asn1/tasn_typ.c 2
/src/boringssl/crypto/x509v3/v3_akeya.c 1
/src/boringssl/crypto/x509v3/v3_crld.c 1
/src/boringssl/crypto/x509v3/v3_genn.c 1
/src/boringssl/crypto/x509v3/v3_ncons.c 1
/src/boringssl/crypto/x509/x_x509a.c 1

Fuzzer: conf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 232 21.4%
gold [1:9] 43 3.97%
yellow [10:29] 25 2.31%
greenyellow [30:49] 9 0.83%
lawngreen 50+ 772 71.4%
All colors 1081 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
40 40 2 :

['sk_X509V3_EXT_METHOD_value', 'sk_X509V3_EXT_METHOD_find']

40 40 X509V3_EXT_get_nid call site: 01001 /src/boringssl/crypto/x509v3/v3_lib.c:114
32 32 3 :

['CRYPTO_atomic_load_u32.2804', 'CRYPTO_get_ex_data', 'sk_void_free']

32 32 CRYPTO_free_ex_data call site: 00271 /src/boringssl/crypto/ex_data.c:212
22 22 2 :

['handle_cpu_env', 'strchr']

22 22 OPENSSL_cpuid_setup call site: 00000 /src/boringssl/crypto/cpu_intel.c:265
16 238 5 :

['CRYPTO_BUFFER_data', 'OPENSSL_memdup', 'CRYPTO_BUFFER_up_ref', 'asn1_encoding_clear', 'CRYPTO_BUFFER_len']

16 238 asn1_enc_save call site: 00868 /src/boringssl/crypto/asn1/tasn_utl.c:154
16 34 3 :

['CRYPTO_STATIC_MUTEX_unlock_read', 'lh_ASN1_OBJECT_retrieve', 'CRYPTO_STATIC_MUTEX_lock_read']

16 92 OBJ_nid2obj call site: 00178 /src/boringssl/crypto/obj/obj.c:345
13 13 2 :

['sk_ASN1_VALUE_pop', 'sk_ASN1_VALUE_num.4928']

13 2036 asn1_template_noexp_d2i call site: 00733 /src/boringssl/crypto/asn1/tasn_dec.c:597
4 28 3 :

['CRYPTO_refcount_dec_and_test_zero', 'free_it', 'OPENSSL_free']

4 28 EVP_PKEY_free call site: 00000 /src/boringssl/crypto/evp/evp.c:107
2 2 1 :

['strlen']

2 219 ASN1_STRING_set call site: 00524 /src/boringssl/crypto/asn1/asn1_lib.c:267
2 2 1 :

['OPENSSL_memory_get_size']

2 85 OPENSSL_realloc call site: 00087 /src/boringssl/crypto/mem.c:306
2 2 1 :

['OPENSSL_memory_alloc']

2 60 OPENSSL_malloc call site: 00024 /src/boringssl/crypto/mem.c:233
2 2 1 :

['__errno_location']

2 6 ERR_put_error call site: 00004 /src/boringssl/crypto/err/err.c:665
2 2 1 :

['OPENSSL_memory_free']

2 2 OPENSSL_free call site: 00030 /src/boringssl/crypto/mem.c:276

Runtime coverage analysis

Covered functions
558
Functions that are reachable but not covered
64
Reachable functions
391
Percentage of reachable functions covered
83.63%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/boringssl/fuzz/conf.cc 1
/src/boringssl/crypto/bio/bio_mem.c 1
/src/boringssl/crypto/err/err.c 8
/src/boringssl/crypto/thread_pthread.c 9
/src/boringssl/crypto/err/../internal.h 1
/src/boringssl/crypto/internal.h 4
/src/boringssl/crypto/bio/bio.c 2
/src/boringssl/crypto/mem.c 19
/src/boringssl/crypto/bio/../internal.h 1
/src/boringssl/crypto/conf/conf.c 17
/src/boringssl/crypto/conf/internal.h 4
/src/boringssl/crypto/lhash/lhash.c 3
/src/boringssl/crypto/lhash/../internal.h 1
/src/boringssl/crypto/buf/buf.c 4
/src/boringssl/crypto/buf/../internal.h 1
/src/boringssl/include/openssl/conf.h 8
/src/boringssl/crypto/stack/stack.c 5
/src/boringssl/crypto/stack/../internal.h 1
/src/boringssl/crypto/conf/../internal.h 1
/src/boringssl/crypto/x509/x_x509.c 5
/src/boringssl/crypto/x509/../internal.h 2
/src/boringssl/crypto/ex_data.c 3
/src/boringssl/crypto/asn1/tasn_new.c 7
/src/boringssl/include/openssl/asn1t.h 6
/src/boringssl/crypto/obj/obj.c 12
/src/boringssl/crypto/asn1/asn1_lib.c 8
/src/boringssl/crypto/asn1/../internal.h 3
/src/boringssl/crypto/asn1/tasn_utl.c 13
/src/boringssl/crypto/asn1/tasn_fre.c 4
/src/boringssl/crypto/asn1/a_object.c 4
/src/boringssl/crypto/asn1/a_type.c 2
/src/boringssl/crypto/refcount.c 2
/src/boringssl/crypto/pool/pool.c 4
/src/boringssl/crypto/pool/internal.h 3
/src/boringssl/crypto/x509/x_algor.c 2
/src/boringssl/crypto/asn1/tasn_typ.c 10
/src/boringssl/include/openssl/stack.h 3
/src/boringssl/crypto/x509v3/v3_akeya.c 1
/src/boringssl/crypto/x509v3/v3_crld.c 1
/src/boringssl/crypto/x509v3/v3_genn.c 1
/src/boringssl/crypto/x509v3/v3_ncons.c 1
/src/boringssl/crypto/x509/x_x509a.c 1
/src/boringssl/crypto/x509v3/v3_conf.c 12
/src/boringssl/crypto/x509v3/../internal.h 2
/usr/include/x86_64-linux-gnu/bits/stdlib-bsearch.h 1
/src/boringssl/crypto/bytestring/cbb.c 22
/src/boringssl/crypto/bytestring/../internal.h 4
/src/boringssl/crypto/bytestring/cbs.c 19
/src/boringssl/crypto/obj/../internal.h 2
/src/boringssl/crypto/x509v3/v3_utl.c 8
/src/boringssl/crypto/x509/asn1_gen.c 6
/src/boringssl/crypto/fipsmodule/bn/bn.c 10
/src/boringssl/crypto/fipsmodule/self_check/../tls/../../internal.h 1
/src/boringssl/crypto/bn_extra/convert.c 3
/src/boringssl/crypto/fipsmodule/bn/cmp.c 1
/src/boringssl/crypto/asn1/a_int.c 6
/src/boringssl/crypto/fipsmodule/bn/bytes.c 3
/src/boringssl/crypto/asn1/posix_time.c 6
/src/boringssl/crypto/asn1/tasn_dec.c 9
/src/boringssl/crypto/asn1/a_mbstr.c 2
/src/boringssl/crypto/bytestring/unicode.c 5
/src/boringssl/crypto/asn1/a_bitstr.c 4
/src/boringssl/crypto/asn1/tasn_enc.c 8
/src/boringssl/crypto/x509/x509_v3.c 6
/src/boringssl/crypto/x509/x_exten.c 3
/src/boringssl/crypto/asn1/a_octet.c 1
/src/boringssl/crypto/x509v3/v3_lib.c 3
/src/boringssl/include/openssl/x509v3.h 3
/src/boringssl/include/openssl/x509.h 4
/src/boringssl/crypto/asn1/a_dup.c 1

Fuzzer: certs_lpm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 224 27.6%
gold [1:9] 20 2.47%
yellow [10:29] 11 1.35%
greenyellow [30:49] 7 0.86%
lawngreen 50+ 547 67.6%
All colors 809 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
1574 3276 14 :

['bn_div_consttime', 'bn_usub_consttime', 'BN_free', 'ERR_put_error', 'BN_num_bits', 'BN_init', 'BN_CTX_new', 'BN_cmp', 'BN_is_one', 'BN_value_one', 'bn_mul_consttime', 'BN_is_negative', 'BN_CTX_free', 'check_mod_inverse']

1574 3276 RSA_check_key call site: 00000 /src/boringssl/crypto/fipsmodule/rsa/rsa.c:816
185 331 4 :

['bn_mul_part_recursive', 'BN_num_bits_word', 'BN_CTX_get', 'bn_mul_recursive']

185 891 bn_mul_impl call site: 00000 /src/boringssl/crypto/fipsmodule/bn/mul.c:455
140 356 2 :

['bn_mod_lshift1_consttime', 'BN_sub_word']

140 3069 BN_mod_sqrt call site: 00000 /src/boringssl/crypto/fipsmodule/bn/sqrt.c:155