Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
uri /src/botan/./src/fuzzer/fuzzers.h 39 97 6 7 180 167 fuzzers.h
mem_pool /src/botan/./src/fuzzer/fuzzers.h 79 104 10 9 507 333 fuzzers.h
mp_comba_mul /src/botan/./src/fuzzer/fuzzers.h 47 153 5 10 145 80 fuzzers.h
mp_comba_sqr /src/botan/./src/fuzzer/fuzzers.h 61 146 5 10 172 96 fuzzers.h
mp_redc /src/botan/./src/fuzzer/fuzzers.h 106 91 10 14 398 212 fuzzers.h
pkcs1 /src/botan/./src/fuzzer/fuzzers.h 108 260 6 12 252 183 fuzzers.h
oaep /src/botan/./src/fuzzer/fuzzers.h 108 290 6 10 345 232 fuzzers.h
mode_padding /src/botan/./src/fuzzer/fuzzers.h 140 411 6 8 310 184 fuzzers.h
redc_p384 /src/botan/./src/fuzzer/fuzzers.h 471 320 13 33 1894 1183 fuzzers.h
redc_p224 /src/botan/./src/fuzzer/fuzzers.h 471 320 13 33 1894 1183 fuzzers.h
redc_p256 /src/botan/./src/fuzzer/fuzzers.h 471 320 13 33 1894 1183 fuzzers.h
bn_cmp /src/botan/./src/fuzzer/fuzzers.h 196 425 9 18 791 432 fuzzers.h
barrett /src/botan/./src/fuzzer/fuzzers.h 445 316 11 30 1803 1122 fuzzers.h
redc_p192 /src/botan/./src/fuzzer/fuzzers.h 465 323 13 33 1884 1176 fuzzers.h
divide /src/botan/./src/fuzzer/fuzzers.h 409 325 9 27 1629 950 fuzzers.h
redc_p521 /src/botan/./src/fuzzer/fuzzers.h 464 323 13 33 1906 1182 fuzzers.h
bn_sqr /src/botan/./src/fuzzer/fuzzers.h 357 490 11 28 1320 777 fuzzers.h
invert /src/botan/./src/fuzzer/fuzzers.h 483 430 10 30 2153 1372 fuzzers.h
asn1 /src/botan/./src/fuzzer/fuzzers.h 293 649 13 35 3050 1967 fuzzers.h
gcd /src/botan/./src/fuzzer/fuzzers.h 397 474 11 27 1445 919 fuzzers.h
pow_mod /src/botan/./src/fuzzer/fuzzers.h 547 395 12 37 2201 1370 fuzzers.h
x509_dn /src/botan/./src/fuzzer/fuzzers.h 195 680 10 25 911 675 fuzzers.h
os2ecp /src/botan/./src/fuzzer/fuzzers.h 916 1416 17 56 6105 3938 fuzzers.h
ressol /src/botan/./src/fuzzer/fuzzers.h 715 2210 15 42 3385 2278 fuzzers.h
ecc_p384 /src/botan/./src/fuzzer/fuzzers.h 1089 2541 17 65 7069 4549 fuzzers.h
ecc_p521 /src/botan/./src/fuzzer/fuzzers.h 1089 2541 17 65 7069 4549 fuzzers.h
ecc_bp256 /src/botan/./src/fuzzer/fuzzers.h 1089 2541 17 65 7069 4549 fuzzers.h
ecc_p256 /src/botan/./src/fuzzer/fuzzers.h 1089 2541 17 65 7069 4549 fuzzers.h
pkcs8 /src/botan/./src/fuzzer/fuzzers.h 499 5575 16 53 5307 3121 fuzzers.h
crl /src/botan/./src/fuzzer/fuzzers.h 148 5645 13 25 682 495 fuzzers.h
cert /src/botan/./src/fuzzer/fuzzers.h 148 5597 13 25 684 498 fuzzers.h
ocsp /src/botan/./src/fuzzer/fuzzers.h 400 5570 14 37 1777 1305 fuzzers.h
x509_path /src/botan/./src/fuzzer/fuzzers.h 828 5503 18 75 6340 4140 fuzzers.h
tls_client_hello /src/botan/./src/fuzzer/fuzzers.h 61 7058 10 10 168 142 fuzzers.h
tls_13_handshake_layer /src/botan/./src/fuzzer/fuzzers.h 655 6771 16 68 5066 3318 fuzzers.h
tls_client /src/botan/./src/fuzzer/fuzzers.h 85 8057 7 13 321 251 fuzzers.h
tls_server /src/botan/./src/fuzzer/fuzzers.h 63 8451 7 13 191 159 fuzzers.h

Fuzzer details

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 5 7.81%
gold [1:9] 13 20.3%
yellow [10:29] 9 14.0%
greenyellow [30:49] 7 10.9%
lawngreen 50+ 30 46.8%
All colors 64 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 0 2 Botan::URI::fromIPv4(std::__1::basic_string_view >) call site: 00000 /src/botan/src/lib/utils/socket/uri.cpp:89

Runtime coverage analysis

Covered functions
14
Functions that are reachable but not covered
14
Reachable functions
39
Percentage of reachable functions covered
64.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/uri.cpp 1
/src/botan/src/lib/utils/socket/uri.cpp 8
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/exceptn.h 1
/src/botan/build/include/botan/internal/uri.h 2

Fuzzer: mem_pool

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 14 28.0%
gold [1:9] 3 6.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 33 66.0%
All colors 50 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 0 0 Botan::Memory_Pool::deallocate(void*,unsignedlong) call site: 00000 /src/botan/src/lib/utils/mem_pool/mem_pool.cpp:365

Runtime coverage analysis

Covered functions
28
Functions that are reachable but not covered
29
Reachable functions
79
Percentage of reachable functions covered
63.29%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mem_pool.cpp 5
/src/botan/src/lib/utils/mem_pool/mem_pool.cpp 17
/src/botan/build/include/botan/mem_ops.h 1
/src/botan/src/lib/utils/assert.cpp 1
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/fmt.h 3
/src/botan/build/include/botan/internal/bit_ops.h 1

Fuzzer: mp_comba_mul

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 20 1.87%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 122 11.4%
lawngreen 50+ 925 86.6%
All colors 1067 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21

Runtime coverage analysis

Covered functions
16
Functions that are reachable but not covered
18
Reachable functions
47
Percentage of reachable functions covered
61.7%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mp_comba_mul.cpp 1
/src/botan/src/lib/math/mp/mp_karat.cpp 1
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/exceptn.h 1
/src/botan/build/include/botan/mem_ops.h 2
/src/botan/build/include/botan/internal/mp_asmi.h 3
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/./src/fuzzer/mp_fuzzers.h 2

Fuzzer: mp_comba_sqr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 20 1.23%
gold [1:9] 0 0.0%
yellow [10:29] 90 5.53%
greenyellow [30:49] 232 14.2%
lawngreen 50+ 1283 78.9%
All colors 1625 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:47

Runtime coverage analysis

Covered functions
23
Functions that are reachable but not covered
18
Reachable functions
61
Percentage of reachable functions covered
70.49%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mp_comba_sqr.cpp 1
/src/botan/src/lib/math/mp/mp_karat.cpp 1
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/exceptn.h 1
/src/botan/build/include/botan/mem_ops.h 2
/src/botan/build/include/botan/internal/mp_asmi.h 4
/src/botan/src/lib/math/mp/mp_comba.cpp 12
/src/botan/./src/fuzzer/mp_fuzzers.h 2

Fuzzer: mp_redc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 32 1.43%
gold [1:9] 2179 97.5%
yellow [10:29] 14 0.62%
greenyellow [30:49] 3 0.13%
lawngreen 50+ 6 0.26%
All colors 2234 100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
18 67 void (anonymous namespace)::fuzz_mp_redc<4ul>(unsigned char const*, unsigned long) call site: 00067 fprintf
8 29 Botan::bigint_sub3(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long) call site: 00029 __cxa_allocate_exception
6 54 Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*) call site: 00054 __cxa_allocate_exception

Runtime coverage analysis

Covered functions
35
Functions that are reachable but not covered
40
Reachable functions
106
Percentage of reachable functions covered
62.26%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mp_redc.cpp 7
/src/botan/src/lib/math/mp/mp_monty_n.cpp 6
/src/botan/build/include/botan/internal/mp_asmi.h 4
/src/botan/build/include/botan/internal/mp_core.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/src/lib/utils/exceptn.cpp 4
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/fmt.h 4
/src/botan/build/include/botan/internal/ct_utils.h 7
/src/botan/build/include/botan/internal/bit_ops.h 3
/src/botan/build/include/botan/mem_ops.h 2
/src/botan/src/lib/math/mp/mp_monty.cpp 1
/src/botan/./src/fuzzer/mp_fuzzers.h 2

Fuzzer: pkcs1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 14 19.7%
gold [1:9] 3 4.22%
yellow [10:29] 6 8.45%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 48 67.6%
All colors 71 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions
54
Functions that are reachable but not covered
26
Reachable functions
108
Percentage of reachable functions covered
75.93%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/pkcs1.cpp 2
/src/botan/src/lib/pk_pad/eme_pkcs1/eme_pkcs.cpp 1
/src/botan/build/include/botan/internal/ct_utils.h 20
/src/botan/build/include/botan/assert.h 3
/src/botan/build/include/botan/internal/bit_ops.h 4
/src/botan/src/lib/utils/ct_utils.cpp 1
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/exceptn.h 1
/src/botan/build/include/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3

Fuzzer: oaep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 12 18.4%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 53 81.5%
All colors 65 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions
57
Functions that are reachable but not covered
19
Reachable functions
108
Percentage of reachable functions covered
82.41%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/oaep.cpp 3
/src/botan/src/lib/pk_pad/eme_oaep/oaep.cpp 1
/src/botan/build/include/botan/internal/ct_utils.h 26
/src/botan/build/include/botan/assert.h 3
/src/botan/src/lib/utils/mem_ops.cpp 1
/src/botan/build/include/botan/internal/bit_ops.h 4
/src/botan/src/lib/utils/ct_utils.cpp 1
/src/botan/build/include/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3

Fuzzer: mode_padding

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 0 0.0%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 85 100.%
All colors 85 100

Runtime coverage analysis

Covered functions
75
Functions that are reachable but not covered
1
Reachable functions
140
Percentage of reachable functions covered
99.29%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mode_padding.cpp 6
/src/botan/build/include/botan/internal/mode_pad.h 4
/src/botan/src/lib/modes/mode_pad/mode_pad.cpp 4
/src/botan/build/include/botan/internal/ct_utils.h 31
/src/botan/build/include/botan/assert.h 3
/src/botan/build/include/botan/internal/bit_ops.h 3
/src/botan/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp 1

Fuzzer: redc_p384

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1186 77.5%
gold [1:9] 64 4.18%
yellow [10:29] 0 0.0%
greenyellow [30:49] 38 2.48%
lawngreen 50+ 242 15.8%
All colors 1530 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
191 191 2 :

['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']

191 224 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:337
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul4(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:298
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
173
Functions that are reachable but not covered
149
Reachable functions
471
Percentage of reachable functions covered
68.37%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p384.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 13
/src/botan/build/include/botan/bigint.h 47
/src/botan/build/include/botan/mem_ops.h 8
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/botan/internal/ct_utils.h 26
/src/botan/build/include/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/botan/exceptn.h 2
/src/botan/build/include/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/botan/assert.h 3
/src/botan/build/include/botan/internal/mp_core.h 16
/src/botan/build/include/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/botan/hex.h 1

Fuzzer: redc_p224

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1204 79.3%
gold [1:9] 81 5.33%
yellow [10:29] 0 0.0%
greenyellow [30:49] 3 0.19%
lawngreen 50+ 230 15.1%
All colors 1518 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
191 191 2 :

['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']

191 224 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:337
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:300
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
171
Functions that are reachable but not covered
153
Reachable functions
471
Percentage of reachable functions covered
67.52%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p224.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 13
/src/botan/build/include/botan/bigint.h 47
/src/botan/build/include/botan/mem_ops.h 8
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/botan/internal/ct_utils.h 26
/src/botan/build/include/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/botan/exceptn.h 2
/src/botan/build/include/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/botan/assert.h 3
/src/botan/build/include/botan/internal/mp_core.h 16
/src/botan/build/include/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/botan/hex.h 1

Fuzzer: redc_p256

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1204 79.2%
gold [1:9] 84 5.52%
yellow [10:29] 0 0.0%
greenyellow [30:49] 1 0.06%
lawngreen 50+ 230 15.1%
All colors 1519 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
191 191 2 :

['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']

191 224 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:337
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:300
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
171
Functions that are reachable but not covered
153
Reachable functions
471
Percentage of reachable functions covered
67.52%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p256.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 13
/src/botan/build/include/botan/bigint.h 47
/src/botan/build/include/botan/mem_ops.h 8
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/botan/internal/ct_utils.h 26
/src/botan/build/include/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/botan/exceptn.h 2
/src/botan/build/include/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/botan/assert.h 3
/src/botan/build/include/botan/internal/mp_core.h 16
/src/botan/build/include/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/botan/hex.h 1

Fuzzer: bn_cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 15 9.09%
gold [1:9] 6 3.63%
yellow [10:29] 0 0.0%
greenyellow [30:49] 3 1.81%
lawngreen 50+ 141 85.4%
All colors 165 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions
88
Functions that are reachable but not covered
39
Reachable functions
196
Percentage of reachable functions covered
80.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/bn_cmp.cpp 1
/src/botan/build/include/botan/bigint.h 31
/src/botan/src/lib/math/bigint/bigint.cpp 7
/src/botan/build/include/botan/mem_ops.h 4
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 4
/src/botan/src/lib/utils/exceptn.cpp 4
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/src/lib/math/bigint/big_ops3.cpp 1
/src/botan/build/include/botan/internal/mp_core.h 7
/src/botan/build/include/botan/internal/mp_asmi.h 4
/src/botan/build/include/botan/internal/ct_utils.h 13
/src/botan/build/include/botan/internal/bit_ops.h 3
/src/botan/build/include/botan/assert.h 2

Fuzzer: barrett

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 93 6.16%
gold [1:9] 577 38.2%
yellow [10:29] 187 12.3%
greenyellow [30:49] 287 19.0%
lawngreen 50+ 365 24.1%
All colors 1509 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']

17 17 Botan::bigint_modop(unsignedlong,unsignedlong,unsignedlong) call site: 00000 /src/botan/build/include/botan/internal/mp_core.h:669
17 17 5 :

['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']

17 17 Botan::bigint_divop(unsignedlong,unsignedlong,unsignedlong) call site: 00000 /src/botan/build/include/botan/internal/mp_core.h:638
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::operator%(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/bigint/big_ops3.cpp:126
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::operator%(Botan::BigIntconst&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/big_ops3.cpp:146
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:305
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:337
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_modulo(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:118
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:156
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73

Runtime coverage analysis

Covered functions
194
Functions that are reachable but not covered
81
Reachable functions
445
Percentage of reachable functions covered
81.8%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/barrett.cpp 1
/src/botan/build/include/botan/bigint.h 47
/src/botan/src/lib/math/bigint/bigint.cpp 14
/src/botan/build/include/botan/mem_ops.h 5
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 4
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/build/include/botan/internal/ct_utils.h 22
/src/botan/build/include/botan/assert.h 2
/src/botan/build/include/botan/internal/bit_ops.h 5
/src/botan/src/lib/math/bigint/big_ops3.cpp 5
/src/botan/build/include/botan/exceptn.h 2
/src/botan/build/include/botan/internal/mp_core.h 19
/src/botan/src/lib/math/bigint/divide.cpp 5
/src/botan/src/lib/math/bigint/big_ops2.cpp 6
/src/botan/build/include/botan/internal/mp_asmi.h 11
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/botan/internal/divide.h 1
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/src/lib/math/bigint/big_code.cpp 2
/src/botan/build/include/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3
/src/botan/build/include/botan/reducer.h 1

Fuzzer: redc_p192

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1204 79.5%
gold [1:9] 64 4.23%
yellow [10:29] 0 0.0%
greenyellow [30:49] 14 0.92%
lawngreen 50+ 231 15.2%
All colors 1513 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
191 191 2 :

['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']

191 224 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:337
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:300
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
168
Functions that are reachable but not covered
153
Reachable functions
465
Percentage of reachable functions covered
67.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p192.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 13
/src/botan/build/include/botan/bigint.h 47
/src/botan/build/include/botan/mem_ops.h 8
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/botan/internal/ct_utils.h 25
/src/botan/build/include/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/botan/exceptn.h 2
/src/botan/build/include/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/botan/assert.h 3
/src/botan/build/include/botan/internal/mp_core.h 16
/src/botan/build/include/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/botan/hex.h 1

Fuzzer: divide

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 92 6.40%
gold [1:9] 17 1.18%
yellow [10:29] 785 54.6%
greenyellow [30:49] 258 17.9%
lawngreen 50+ 284 19.7%
All colors 1436 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
182 182 2 :

['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']

182 194 Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:105
114 114 1 :

['Botan::bigint_sub_abs(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)']

114 155 Botan::BigInt::add2(Botan::BigIntconst&,unsignedlongconst*,unsignedlong,Botan::BigInt::Sign) call site: 00000 /src/botan/src/lib/math/bigint/big_ops3.cpp:24
17 17 5 :

['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']

17 17 Botan::bigint_divop(unsignedlong,unsignedlong,unsignedlong) call site: 00000 /src/botan/build/include/botan/internal/mp_core.h:638
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:305
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:81
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:156
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
0 10 1 :

['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']

0 10 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:296
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/mem_ops.cpp:27
0 0 None 0 84 Botan::BigInt::is_less_than(Botan::BigIntconst&)const call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:174
0 0 None 0 33 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:315

Runtime coverage analysis

Covered functions
172
Functions that are reachable but not covered
92
Reachable functions
409
Percentage of reachable functions covered
77.51%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/divide.cpp 1
/src/botan/build/include/botan/bigint.h 42
/src/botan/src/lib/math/bigint/bigint.cpp 15
/src/botan/build/include/botan/mem_ops.h 5
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 4
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/build/include/botan/internal/ct_utils.h 22
/src/botan/build/include/botan/assert.h 2
/src/botan/build/include/botan/internal/bit_ops.h 4
/src/botan/build/include/botan/internal/mp_core.h 16
/src/botan/src/lib/math/bigint/divide.cpp 5
/src/botan/build/include/botan/exceptn.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 3
/src/botan/src/lib/math/bigint/big_ops3.cpp 4
/src/botan/build/include/botan/internal/mp_asmi.h 9
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/src/lib/math/bigint/big_code.cpp 2
/src/botan/build/include/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3

Fuzzer: redc_p521

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1132 75.2%
gold [1:9] 65 4.32%
yellow [10:29] 87 5.78%
greenyellow [30:49] 7 0.46%
lawngreen 50+ 213 14.1%
All colors 1504 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
191 191 2 :

['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']

191 224 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
74 74 1 :

['Botan::bigint_sub2(unsigned long*, unsigned long, unsigned long const*, unsigned long)']

74 130 Botan::BigInt::add(unsignedlongconst*,unsignedlong,Botan::BigInt::Sign) call site: 00000 /src/botan/src/lib/math/bigint/big_ops2.cpp:26
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:337
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul4(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:298
4 4 1 :

['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:300
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306

Runtime coverage analysis

Covered functions
175
Functions that are reachable but not covered
138
Reachable functions
464
Percentage of reachable functions covered
70.26%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p521.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 2
/src/botan/src/lib/math/bigint/bigint.cpp 13
/src/botan/build/include/botan/bigint.h 47
/src/botan/build/include/botan/mem_ops.h 8
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/botan/internal/loadstor.h 1
/src/botan/build/include/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/botan/internal/ct_utils.h 27
/src/botan/build/include/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/botan/exceptn.h 2
/src/botan/build/include/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/botan/assert.h 2
/src/botan/build/include/botan/internal/mp_core.h 18
/src/botan/build/include/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp