High level conclusions

Fuzzers reach 20.77% of cyclomatic complexity.

Fuzzers reach 14.23% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1225 / 8603

Cyclomatic complexity statically reachable by fuzzers

10687 / 51437

Runtime code coverage of functions

2925 / 8603

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	7.81%
gold	[1:9]	13	20.3%
yellow	[10:29]	9	14.0%
greenyellow	[30:49]	7	10.9%
lawngreen	50+	30	46.8%
All colors	64	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	2	Botan::URI::fromIPv4(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/utils/socket/uri.cpp:89

Runtime coverage analysis

Covered functions

14

Functions that are reachable but not covered

14

Reachable functions

39

Percentage of reachable functions covered

64.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/uri.cpp	1
/src/botan/src/lib/utils/socket/uri.cpp	8
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/internal/uri.h	2

Fuzzer: mem_pool

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	28.0%
gold	[1:9]	3	6.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	33	66.0%
All colors	50	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	Botan::Memory_Pool::deallocate(void*,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_pool/mem_pool.cpp:365

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

29

Reachable functions

79

Percentage of reachable functions covered

63.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mem_pool.cpp	5
/src/botan/src/lib/utils/mem_pool/mem_pool.cpp	17
/src/botan/build/include/botan/mem_ops.h	1
/src/botan/src/lib/utils/assert.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	3
/src/botan/build/include/botan/internal/bit_ops.h	1

Fuzzer: mp_comba_mul

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	1.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	122	11.4%
lawngreen	50+	925	86.6%
All colors	1067	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

18

Reachable functions

47

Percentage of reachable functions covered

61.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mp_comba_mul.cpp	1
/src/botan/src/lib/math/mp/mp_karat.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/build/include/botan/internal/mp_asmi.h	3
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/./src/fuzzer/mp_fuzzers.h	2

Fuzzer: mp_comba_sqr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	1.23%
gold	[1:9]	0	0.0%
yellow	[10:29]	90	5.53%
greenyellow	[30:49]	232	14.2%
lawngreen	50+	1283	78.9%
All colors	1625	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:47

Runtime coverage analysis

Covered functions

23

Functions that are reachable but not covered

18

Reachable functions

61

Percentage of reachable functions covered

70.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mp_comba_sqr.cpp	1
/src/botan/src/lib/math/mp/mp_karat.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/build/include/botan/internal/mp_asmi.h	4
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/./src/fuzzer/mp_fuzzers.h	2

Fuzzer: mp_redc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	1.43%
gold	[1:9]	2179	97.5%
yellow	[10:29]	14	0.62%
greenyellow	[30:49]	3	0.13%
lawngreen	50+	6	0.26%
All colors	2234	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	67	void (anonymous namespace)::fuzz_mp_redc<4ul>(unsigned char const*, unsigned long)	call site: 00067	fprintf
8	29	Botan::bigint_sub3(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)	call site: 00029	__cxa_allocate_exception
6	54	Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*)	call site: 00054	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

40

Reachable functions

106

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mp_redc.cpp	7
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/build/include/botan/internal/mp_asmi.h	4
/src/botan/build/include/botan/internal/mp_core.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/src/lib/utils/exceptn.cpp	4
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/build/include/botan/internal/ct_utils.h	7
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/./src/fuzzer/mp_fuzzers.h	2

Fuzzer: pkcs1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	19.7%
gold	[1:9]	3	4.22%
yellow	[10:29]	6	8.45%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	48	67.6%
All colors	71	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

26

Reachable functions

108

Percentage of reachable functions covered

75.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/pkcs1.cpp	2
/src/botan/src/lib/pk_pad/eme_pkcs1/eme_pkcs.cpp	1
/src/botan/build/include/botan/internal/ct_utils.h	20
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/src/lib/utils/ct_utils.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: oaep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	18.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	53	81.5%
All colors	65	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions

57

Functions that are reachable but not covered

19

Reachable functions

108

Percentage of reachable functions covered

82.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/oaep.cpp	3
/src/botan/src/lib/pk_pad/eme_oaep/oaep.cpp	1
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/assert.h	3
/src/botan/src/lib/utils/mem_ops.cpp	1
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/src/lib/utils/ct_utils.cpp	1
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: mode_padding

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	85	100.%
All colors	85	100

Runtime coverage analysis

Covered functions

75

Functions that are reachable but not covered

1

Reachable functions

140

Percentage of reachable functions covered

99.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mode_padding.cpp	6
/src/botan/build/include/botan/internal/mode_pad.h	4
/src/botan/src/lib/modes/mode_pad/mode_pad.cpp	4
/src/botan/build/include/botan/internal/ct_utils.h	31
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp	1

Fuzzer: redc_p384

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1186	77.5%
gold	[1:9]	64	4.18%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	38	2.48%
lawngreen	50+	242	15.8%
All colors	1530	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul4(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:298
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

173

Functions that are reachable but not covered

149

Reachable functions

471

Percentage of reachable functions covered

68.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p384.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: redc_p224

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1204	79.3%
gold	[1:9]	81	5.33%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.19%
lawngreen	50+	230	15.1%
All colors	1518	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

153

Reachable functions

471

Percentage of reachable functions covered

67.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p224.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: redc_p256

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1204	79.2%
gold	[1:9]	84	5.52%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	230	15.1%
All colors	1519	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

153

Reachable functions

471

Percentage of reachable functions covered

67.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p256.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: bn_cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	9.09%
gold	[1:9]	6	3.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	1.81%
lawngreen	50+	141	85.4%
All colors	165	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions

88

Functions that are reachable but not covered

39

Reachable functions

196

Percentage of reachable functions covered

80.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/bn_cmp.cpp	1
/src/botan/build/include/botan/bigint.h	31
/src/botan/src/lib/math/bigint/bigint.cpp	7
/src/botan/build/include/botan/mem_ops.h	4
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	4
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/math/bigint/big_ops3.cpp	1
/src/botan/build/include/botan/internal/mp_core.h	7
/src/botan/build/include/botan/internal/mp_asmi.h	4
/src/botan/build/include/botan/internal/ct_utils.h	13
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/build/include/botan/assert.h	2

Fuzzer: barrett

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	93	6.16%
gold	[1:9]	577	38.2%
yellow	[10:29]	187	12.3%
greenyellow	[30:49]	287	19.0%
lawngreen	50+	365	24.1%
All colors	1509	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_modop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:669
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_divop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:638
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::operator%(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:126
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::operator%(Botan::BigIntconst&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:146
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:305
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_modulo(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:118
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:156
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

81

Reachable functions

445

Percentage of reachable functions covered

81.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/barrett.cpp	1
/src/botan/build/include/botan/bigint.h	47
/src/botan/src/lib/math/bigint/bigint.cpp	14
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	22
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/math/bigint/big_ops3.cpp	5
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/internal/mp_core.h	19
/src/botan/src/lib/math/bigint/divide.cpp	5
/src/botan/src/lib/math/bigint/big_ops2.cpp	6
/src/botan/build/include/botan/internal/mp_asmi.h	11
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/src/botan/build/include/botan/reducer.h	1

Fuzzer: redc_p192

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1204	79.5%
gold	[1:9]	64	4.23%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	14	0.92%
lawngreen	50+	231	15.2%
All colors	1513	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

168

Functions that are reachable but not covered

153

Reachable functions

465

Percentage of reachable functions covered

67.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p192.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	25
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: divide

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	6.40%
gold	[1:9]	17	1.18%
yellow	[10:29]	785	54.6%
greenyellow	[30:49]	258	17.9%
lawngreen	50+	284	19.7%
All colors	1436	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
182	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	182	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
114	114	1 : View List ['Botan::bigint_sub_abs(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)']	114	155	Botan::BigInt::add2(Botan::BigIntconst&,unsignedlongconst*,unsignedlong,Botan::BigInt::Sign)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:24
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_divop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:638
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:305
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:81
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:156
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
0	10	1 : View List ['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']	0	10	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:296
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27
0	0	None	0	84	Botan::BigInt::is_less_than(Botan::BigIntconst&)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:174
0	0	None	0	33	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:315

Runtime coverage analysis

Covered functions

172

Functions that are reachable but not covered

92

Reachable functions

409

Percentage of reachable functions covered

77.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/divide.cpp	1
/src/botan/build/include/botan/bigint.h	42
/src/botan/src/lib/math/bigint/bigint.cpp	15
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	22
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/src/lib/math/bigint/divide.cpp	5
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	3
/src/botan/src/lib/math/bigint/big_ops3.cpp	4
/src/botan/build/include/botan/internal/mp_asmi.h	9
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: redc_p521

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1132	75.2%
gold	[1:9]	65	4.32%
yellow	[10:29]	87	5.78%
greenyellow	[30:49]	7	0.46%
lawngreen	50+	213	14.1%
All colors	1504	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
74	74	1 : View List ['Botan::bigint_sub2(unsigned long*, unsigned long, unsigned long const*, unsigned long)']	74	130	Botan::BigInt::add(unsignedlongconst*,unsignedlong,Botan::BigInt::Sign)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops2.cpp:26
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul4(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:298
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306

Runtime coverage analysis

Covered functions

175

Functions that are reachable but not covered

138

Reachable functions

464

Percentage of reachable functions covered

70.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p521.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	2
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	27
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/mp_core.h	18
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp