High level conclusions

Fuzzers reach 20.77% of cyclomatic complexity.

Fuzzers reach 14.23% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1225 / 8603

Cyclomatic complexity statically reachable by fuzzers

10687 / 51437

Runtime code coverage of functions

2925 / 8603

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	7.81%
gold	[1:9]	13	20.3%
yellow	[10:29]	9	14.0%
greenyellow	[30:49]	7	10.9%
lawngreen	50+	30	46.8%
All colors	64	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	2	Botan::URI::fromIPv4(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/utils/socket/uri.cpp:89

Runtime coverage analysis

Covered functions

14

Functions that are reachable but not covered

14

Reachable functions

39

Percentage of reachable functions covered

64.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/uri.cpp	1
/src/botan/src/lib/utils/socket/uri.cpp	8
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/internal/uri.h	2

Fuzzer: mem_pool

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	28.0%
gold	[1:9]	3	6.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	33	66.0%
All colors	50	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	Botan::Memory_Pool::deallocate(void*,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_pool/mem_pool.cpp:365

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

29

Reachable functions

79

Percentage of reachable functions covered

63.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mem_pool.cpp	5
/src/botan/src/lib/utils/mem_pool/mem_pool.cpp	17
/src/botan/build/include/botan/mem_ops.h	1
/src/botan/src/lib/utils/assert.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	3
/src/botan/build/include/botan/internal/bit_ops.h	1

Fuzzer: mp_comba_mul

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	1.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	122	11.4%
lawngreen	50+	925	86.6%
All colors	1067	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

18

Reachable functions

47

Percentage of reachable functions covered

61.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mp_comba_mul.cpp	1
/src/botan/src/lib/math/mp/mp_karat.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/build/include/botan/internal/mp_asmi.h	3
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/./src/fuzzer/mp_fuzzers.h	2

Fuzzer: mp_comba_sqr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	1.23%
gold	[1:9]	0	0.0%
yellow	[10:29]	90	5.53%
greenyellow	[30:49]	232	14.2%
lawngreen	50+	1283	78.9%
All colors	1625	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:47

Runtime coverage analysis

Covered functions

23

Functions that are reachable but not covered

18

Reachable functions

61

Percentage of reachable functions covered

70.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mp_comba_sqr.cpp	1
/src/botan/src/lib/math/mp/mp_karat.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/build/include/botan/internal/mp_asmi.h	4
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/./src/fuzzer/mp_fuzzers.h	2

Fuzzer: mp_redc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	1.43%
gold	[1:9]	2179	97.5%
yellow	[10:29]	14	0.62%
greenyellow	[30:49]	3	0.13%
lawngreen	50+	6	0.26%
All colors	2234	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	67	void (anonymous namespace)::fuzz_mp_redc<4ul>(unsigned char const*, unsigned long)	call site: 00067	fprintf
8	29	Botan::bigint_sub3(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)	call site: 00029	__cxa_allocate_exception
6	54	Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*)	call site: 00054	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

40

Reachable functions

106

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mp_redc.cpp	7
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/build/include/botan/internal/mp_asmi.h	4
/src/botan/build/include/botan/internal/mp_core.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/src/lib/utils/exceptn.cpp	4
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/build/include/botan/internal/ct_utils.h	7
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/./src/fuzzer/mp_fuzzers.h	2

Fuzzer: pkcs1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	19.7%
gold	[1:9]	3	4.22%
yellow	[10:29]	6	8.45%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	48	67.6%
All colors	71	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

26

Reachable functions

108

Percentage of reachable functions covered

75.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/pkcs1.cpp	2
/src/botan/src/lib/pk_pad/eme_pkcs1/eme_pkcs.cpp	1
/src/botan/build/include/botan/internal/ct_utils.h	20
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/src/lib/utils/ct_utils.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	2
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: oaep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	18.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	53	81.5%
All colors	65	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions

57

Functions that are reachable but not covered

19

Reachable functions

108

Percentage of reachable functions covered

82.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/oaep.cpp	3
/src/botan/src/lib/pk_pad/eme_oaep/oaep.cpp	1
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/assert.h	3
/src/botan/src/lib/utils/mem_ops.cpp	1
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/src/lib/utils/ct_utils.cpp	1
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: mode_padding

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	85	100.%
All colors	85	100

Runtime coverage analysis

Covered functions

75

Functions that are reachable but not covered

1

Reachable functions

140

Percentage of reachable functions covered

99.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/mode_padding.cpp	6
/src/botan/build/include/botan/internal/mode_pad.h	4
/src/botan/src/lib/modes/mode_pad/mode_pad.cpp	4
/src/botan/build/include/botan/internal/ct_utils.h	31
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp	1

Fuzzer: redc_p384

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1186	77.5%
gold	[1:9]	64	4.18%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	38	2.48%
lawngreen	50+	242	15.8%
All colors	1530	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul4(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:298
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

173

Functions that are reachable but not covered

149

Reachable functions

471

Percentage of reachable functions covered

68.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p384.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: redc_p224

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1204	79.3%
gold	[1:9]	81	5.33%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.19%
lawngreen	50+	230	15.1%
All colors	1518	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

153

Reachable functions

471

Percentage of reachable functions covered

67.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p224.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: redc_p256

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1204	79.2%
gold	[1:9]	84	5.52%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	230	15.1%
All colors	1519	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

153

Reachable functions

471

Percentage of reachable functions covered

67.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p256.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: bn_cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	9.09%
gold	[1:9]	6	3.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	1.81%
lawngreen	50+	141	85.4%
All colors	165	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27

Runtime coverage analysis

Covered functions

88

Functions that are reachable but not covered

39

Reachable functions

196

Percentage of reachable functions covered

80.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/bn_cmp.cpp	1
/src/botan/build/include/botan/bigint.h	31
/src/botan/src/lib/math/bigint/bigint.cpp	7
/src/botan/build/include/botan/mem_ops.h	4
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	4
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/math/bigint/big_ops3.cpp	1
/src/botan/build/include/botan/internal/mp_core.h	7
/src/botan/build/include/botan/internal/mp_asmi.h	4
/src/botan/build/include/botan/internal/ct_utils.h	13
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/build/include/botan/assert.h	2

Fuzzer: barrett

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	93	6.16%
gold	[1:9]	577	38.2%
yellow	[10:29]	187	12.3%
greenyellow	[30:49]	287	19.0%
lawngreen	50+	365	24.1%
All colors	1509	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_modop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:669
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_divop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:638
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::operator%(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:126
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::operator%(Botan::BigIntconst&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:146
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:305
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_modulo(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:118
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:156
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

81

Reachable functions

445

Percentage of reachable functions covered

81.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/barrett.cpp	1
/src/botan/build/include/botan/bigint.h	47
/src/botan/src/lib/math/bigint/bigint.cpp	14
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	22
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/math/bigint/big_ops3.cpp	5
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/internal/mp_core.h	19
/src/botan/src/lib/math/bigint/divide.cpp	5
/src/botan/src/lib/math/bigint/big_ops2.cpp	6
/src/botan/build/include/botan/internal/mp_asmi.h	11
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/src/botan/build/include/botan/reducer.h	1

Fuzzer: redc_p192

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1204	79.5%
gold	[1:9]	64	4.23%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	14	0.92%
lawngreen	50+	231	15.2%
All colors	1513	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:304
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306
4	4	1 : View List ['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions

168

Functions that are reachable but not covered

153

Reachable functions

465

Percentage of reachable functions covered

67.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p192.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	4
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	25
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: divide

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	6.40%
gold	[1:9]	17	1.18%
yellow	[10:29]	785	54.6%
greenyellow	[30:49]	258	17.9%
lawngreen	50+	284	19.7%
All colors	1436	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
182	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	182	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
114	114	1 : View List ['Botan::bigint_sub_abs(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)']	114	155	Botan::BigInt::add2(Botan::BigIntconst&,unsignedlongconst*,unsignedlong,Botan::BigInt::Sign)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:24
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_divop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:638
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:305
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:81
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:156
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
0	10	1 : View List ['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']	0	10	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:296
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27
0	0	None	0	84	Botan::BigInt::is_less_than(Botan::BigIntconst&)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:174
0	0	None	0	33	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:315

Runtime coverage analysis

Covered functions

172

Functions that are reachable but not covered

92

Reachable functions

409

Percentage of reachable functions covered

77.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/divide.cpp	1
/src/botan/build/include/botan/bigint.h	42
/src/botan/src/lib/math/bigint/bigint.cpp	15
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	22
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/build/include/botan/internal/mp_core.h	16
/src/botan/src/lib/math/bigint/divide.cpp	5
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	3
/src/botan/src/lib/math/bigint/big_ops3.cpp	4
/src/botan/build/include/botan/internal/mp_asmi.h	9
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: redc_p521

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1132	75.2%
gold	[1:9]	65	4.32%
yellow	[10:29]	87	5.78%
greenyellow	[30:49]	7	0.46%
lawngreen	50+	213	14.1%
All colors	1504	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
74	74	1 : View List ['Botan::bigint_sub2(unsigned long*, unsigned long, unsigned long const*, unsigned long)']	74	130	Botan::BigInt::add(unsignedlongconst*,unsignedlong,Botan::BigInt::Sign)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops2.cpp:26
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73
4	4	1 : View List ['Botan::bigint_comba_mul4(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:298
4	4	1 : View List ['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:300
4	4	1 : View List ['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:302
4	4	1 : View List ['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']	4	4	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:306

Runtime coverage analysis

Covered functions

175

Functions that are reachable but not covered

138

Reachable functions

464

Percentage of reachable functions covered

70.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/redc_p521.cpp	1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp	2
/src/botan/src/lib/math/bigint/bigint.cpp	13
/src/botan/build/include/botan/bigint.h	47
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/math/bigint/big_code.cpp	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/codec/hex/hex.cpp	7
/src/botan/build/include/botan/internal/ct_utils.h	27
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	5
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/mp_core.h	18
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/reducer.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/build/include/botan/hex.h	1

Fuzzer: bn_sqr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	6.38%
gold	[1:9]	235	12.6%
yellow	[10:29]	381	20.4%
greenyellow	[30:49]	1	0.05%
lawngreen	50+	1128	60.5%
All colors	1864	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:47
0	22	1 : View List ['Botan::bigint_add3_nc(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)']	0	22	Botan::bigint_add3_nc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:224
0	10	1 : View List ['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']	0	10	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:296
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27
0	0	None	0	329	Botan::operator*(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:54
0	0	None	0	33	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:315
0	0	None	0	10	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:294
0	0	None	0	8	Botan::bigint_ct_is_eq(unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:552

Runtime coverage analysis

Covered functions

126

Functions that are reachable but not covered

122

Reachable functions

357

Percentage of reachable functions covered

65.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/bn_sqr.cpp	1
/src/botan/build/include/botan/bigint.h	37
/src/botan/src/lib/math/bigint/bigint.cpp	10
/src/botan/build/include/botan/mem_ops.h	4
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/math/numbertheory/numthry.cpp	1
/src/botan/src/lib/math/bigint/big_ops2.cpp	2
/src/botan/build/include/botan/internal/ct_utils.h	18
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/build/include/botan/internal/mp_core.h	10
/src/botan/build/include/botan/internal/mp_asmi.h	13
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/math/bigint/big_ops3.cpp	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/src/lib/math/bigint/divide.cpp	1
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: invert

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	137	8.53%
gold	[1:9]	1	0.06%
yellow	[10:29]	121	7.53%
greenyellow	[30:49]	644	40.0%
lawngreen	50+	703	43.7%
All colors	1606	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_cond_add(bool,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:415
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_modulo(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:118
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:182
0	10	1 : View List ['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']	0	10	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:296
0	6	1 : View List ['Botan::BigInt::Data::set_to_zero()']	0	6	Botan::BigInt::Data::mask_bits(unsignedlong)	call site: 00000	/src/botan/build/include/botan/bigint.h:864
0	0	None	17	17	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:179
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27
0	0	None	0	185	Botan::operator>>(Botan::BigIntconst&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:193
0	0	None	0	84	Botan::BigInt::is_less_than(Botan::BigIntconst&)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:174
0	0	None	0	48	Botan::BigInt::cmp(Botan::BigIntconst&,bool)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:149
0	0	None	0	10	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:294

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

104

Reachable functions

483

Percentage of reachable functions covered

78.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/invert.cpp	2
/src/botan/build/include/botan/bigint.h	58
/src/botan/src/lib/math/bigint/bigint.cpp	18
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	27
/src/botan/build/include/botan/assert.h	3
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/build/include/botan/internal/mp_core.h	23
/src/botan/src/lib/math/numbertheory/mod_inv.cpp	3
/src/botan/build/include/botan/exceptn.h	1
/src/botan/build/include/botan/internal/mp_asmi.h	12
/src/botan/src/lib/math/bigint/divide.cpp	2
/src/botan/src/lib/math/bigint/big_ops2.cpp	6
/src/botan/src/lib/math/bigint/big_ops3.cpp	3
/src/botan/src/lib/math/numbertheory/numthry.cpp	4
/src/botan/src/lib/math/mp/mp_karat.cpp	10
/src/botan/src/lib/math/mp/mp_comba.cpp	6
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/src/botan/build/include/botan/numthry.h	1

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	6.80%
gold	[1:9]	249	52.9%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	189	40.2%
All colors	470	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6	17	7 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, char const*)', '__cxa_allocate_exception', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator > const&)']	6	17	Botan::to_u32bit(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/utils/parsing.cpp:46
4	4	3 : View List ['std::__1::pair ::type, std::__1::__unwrap_ref_decay ::type> std::__1::make_pair (unsigned char const*&, unsigned long&)', 'std::__1::vector >& Botan::operator+= , unsigned long>(std::__1::vector >&, std::__1::pair const&)', 'std::__1::vector >& Botan::operator+= , std::__1::allocator >(std::__1::vector >&, std::__1::vector > const&)']	4	4	Botan::DER_Encoder::add_object(Botan::ASN1_Type,Botan::ASN1_Class,unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/asn1/der_enc.cpp:225
0	0	None	62	69	Botan::(anonymousnamespace)::encode_tag(std::__1::vector >&,Botan::ASN1_Type,Botan::ASN1_Class)	call site: 00000	/src/botan/src/lib/asn1/der_enc.cpp:28
0	0	None	16	320	Botan::BER_Decoder::get_next_object()	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:253
0	0	None	16	61	Botan::OID::decode_from(Botan::BER_Decoder&)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:187
0	0	None	10	74	Botan::(anonymousnamespace)::decode_length(Botan::DataSource*,unsignedlong&,unsignedlong)	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:98
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27
0	0	None	6	120	Botan::BER_Object::assert_is_a(Botan::ASN1_Type,Botan::ASN1_Class,std::__1::basic_string_view >)const	call site: 00000	/src/botan/src/lib/asn1/asn1_obj.cpp:37
0	0	None	6	78	Botan::BER_Object::assert_is_a(Botan::ASN1_Type,Botan::ASN1_Class,std::__1::basic_string_view >)const	call site: 00000	/src/botan/src/lib/asn1/asn1_obj.cpp:34
0	0	1 : View List ['std::__1::to_string(unsigned int)']	6	50	Botan::BER_Object::assert_is_a(Botan::ASN1_Type,Botan::ASN1_Class,std::__1::basic_string_view >)const	call site: 00000	/src/botan/src/lib/asn1/asn1_obj.cpp:48
0	0	None	4	136	Botan::ASN1_String::decode_from(Botan::BER_Decoder&)	call site: 00000	/src/botan/src/lib/asn1/asn1_str.cpp:89
0	0	None	4	4	Botan::DER_Encoder::add_object(Botan::ASN1_Type,Botan::ASN1_Class,unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/asn1/der_enc.cpp:223

Runtime coverage analysis

Covered functions

181

Functions that are reachable but not covered

55

Reachable functions

293

Percentage of reachable functions covered

81.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/asn1.cpp	2
/src/botan/build/include/botan/asn1_print.h	1
/src/botan/src/lib/asn1/asn1_print.cpp	4
/src/botan/src/lib/asn1/ber_dec.cpp	10
/src/botan/build/include/botan/asn1_obj.h	21
/src/botan/src/lib/utils/data_src.cpp	2
/src/botan/src/lib/asn1/asn1_obj.cpp	7
/src/botan/build/include/botan/internal/fmt.h	7
/src/botan/src/lib/utils/exceptn.cpp	3
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/data_src.h	3
/src/botan/build/include/botan/internal/loadstor.h	2
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/src/lib/asn1/der_enc.cpp	1
/src/botan/build/include/botan/der_enc.h	1
/src/botan/build/include/botan/ber_dec.h	4
/usr/include/ctype.h	1
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/src/lib/asn1/asn1_oid.cpp	3
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/src/lib/utils/assert.cpp	1
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/build/include/botan/bigint.h	14
/src/botan/src/lib/math/bigint/bigint.cpp	2
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/asn1/asn1_str.cpp	5
/src/botan/build/include/botan/internal/ct_utils.h	10
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	1
/src/botan/src/lib/asn1/asn1_time.cpp	2

Fuzzer: gcd

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	26.2%
gold	[1:9]	2	0.5%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	293	73.2%
All colors	400	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_modop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:669
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::bigint_divop(unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:638
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::operator%(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:126
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::operator%(Botan::BigIntconst&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:146
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:305
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_cond_add(bool,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:415
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:156
0	0	None	17	17	Botan::operator%(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops3.cpp:123
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27
0	0	None	0	84	Botan::BigInt::is_less_than(Botan::BigIntconst&)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:174
0	0	None	0	8	Botan::bigint_ct_is_eq(unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:552

Runtime coverage analysis

Covered functions

164

Functions that are reachable but not covered

94

Reachable functions

397

Percentage of reachable functions covered

76.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/gcd.cpp	2
/src/botan/build/include/botan/bigint.h	53
/src/botan/src/lib/math/bigint/bigint.cpp	16
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	5
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	22
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	6
/src/botan/build/include/botan/internal/mp_core.h	15
/src/botan/src/lib/math/bigint/big_ops3.cpp	5
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/src/lib/math/bigint/big_ops2.cpp	2
/src/botan/build/include/botan/internal/mp_asmi.h	6
/src/botan/src/lib/math/numbertheory/numthry.cpp	4
/src/botan/build/include/botan/numthry.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: pow_mod

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	117	3.74%
gold	[1:9]	12	0.38%
yellow	[10:29]	6	0.19%
greenyellow	[30:49]	1	0.03%
lawngreen	50+	2989	95.6%
All colors	3125	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
38	38	5 : View List ['__cxa_free_exception', '__cxa_throw', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Internal_Error::Internal_Error(std::__1::basic_string_view >)', '__cxa_allocate_exception']	38	38	Botan::Montgomery_Int::fix_size()	call site: 00000	/src/botan/src/lib/math/numbertheory/monty.cpp:295
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	33	Botan::Montgomery_Params::Montgomery_Params(Botan::BigIntconst&,Botan::Modular_Reducerconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/monty.cpp:45
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	25	Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:20
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::get_substring(unsignedlong,unsignedlong)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:217
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong)	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:337
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:49
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::ct_modulo(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:118
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:21
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::basecase_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:47
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', '__cxa_allocate_exception']	17	17	Botan::monty_inverse(unsignedlong)	call site: 00000	/src/botan/src/lib/math/numbertheory/monty.cpp:17
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Montgomery_Exponentation_State::Montgomery_Exponentation_State(std::__1::shared_ptr const&,Botan::BigIntconst&,unsignedlong,bool)	call site: 00000	/src/botan/src/lib/math/numbertheory/monty_exp.cpp:43
0	74	1 : View List ['Botan::bigint_sub2(unsigned long*, unsigned long, unsigned long const*, unsigned long)']	0	130	Botan::BigInt::add(unsignedlongconst*,unsignedlong,Botan::BigInt::Sign)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops2.cpp:26

Runtime coverage analysis

Covered functions

245

Functions that are reachable but not covered

97

Reachable functions

547

Percentage of reachable functions covered

82.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/pow_mod.cpp	2
/src/botan/build/include/botan/bigint.h	54
/src/botan/src/lib/math/bigint/bigint.cpp	18
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	4
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	24
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	4
/src/botan/build/include/botan/internal/mp_core.h	17
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	4
/src/botan/build/include/botan/exceptn.h	2
/src/botan/src/lib/math/bigint/big_ops3.cpp	2
/src/botan/build/include/botan/internal/mp_asmi.h	14
/src/botan/src/lib/math/bigint/big_ops2.cpp	6
/src/botan/build/include/botan/reducer.h	3
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/src/lib/math/numbertheory/numthry.cpp	2
/src/botan/build/include/botan/internal/monty_exp.h	1
/src/botan/src/lib/math/numbertheory/monty_exp.cpp	4
/src/botan/build/include/botan/internal/monty.h	6
/src/botan/src/lib/math/numbertheory/monty.cpp	8
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: x509_dn

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	39	21.3%
gold	[1:9]	6	3.27%
yellow	[10:29]	12	6.55%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	126	68.8%
All colors	183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11	11	1 : View List ['Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)']	17	17	Botan::BER_Decoder::end_cons()	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:294
0	0	None	16	320	Botan::BER_Decoder::get_next_object()	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:253
0	0	None	10	74	Botan::(anonymousnamespace)::decode_length(Botan::DataSource*,unsignedlong&,unsignedlong)	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:98
0	0	None	8	8	Botan::allocate_memory(unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/utils/mem_ops.cpp:27
0	0	4 : View List ['std::__1::basic_string_view >::operator[](unsigned long) const', 'std::__1::basic_ostream >& std::__1::operator<< >(std::__1::basic_ostream >&, char)', 'std::__1::basic_string_view >::size() const', 'std::__1::basic_string_view >::at(unsigned long) const']	0	9	voidBotan::fmt_detail::do_fmt >,unsignedint>(std::__1::basic_ostringstream ,std::__1::allocator >&,std::__1::basic_string_view >,std::__1::basic_string_view >const&,unsignedintconst&)	call site: 00000	/src/botan/build/include/botan/internal/fmt.h:27
0	0	None	0	0	Botan::ASN1_String::ASN1_String(std::__1::basic_string_view >,Botan::ASN1_Type)	call site: 00000	/src/botan/src/lib/asn1/asn1_str.cpp:63
0	0	None	0	0	Botan::(anonymousnamespace)::choose_encoding(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_str.cpp:40

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

58

Reachable functions

195

Percentage of reachable functions covered

70.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/x509_dn.cpp	1
/src/botan/build/include/botan/pkix_types.h	2
/src/botan/build/include/botan/asn1_obj.h	15
/src/botan/src/lib/asn1/ber_dec.cpp	11
/src/botan/src/lib/x509/x509_dn.cpp	8
/src/botan/build/include/botan/ber_dec.h	3
/src/botan/src/lib/utils/data_src.cpp	2
/src/botan/src/lib/asn1/asn1_obj.cpp	6
/src/botan/build/include/botan/internal/fmt.h	5
/src/botan/src/lib/utils/exceptn.cpp	4
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/data_src.h	3
/src/botan/build/include/botan/internal/loadstor.h	1
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/src/lib/asn1/asn1_str.cpp	2
/src/botan/build/include/botan/internal/ct_utils.h	10
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	1
/src/botan/build/include/botan/internal/stl_util.h	1
/usr/include/ctype.h	2
/src/botan/src/lib/asn1/asn1_oid.cpp	1
/src/botan/src/lib/utils/assert.cpp	1

Fuzzer: os2ecp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1800	46.1%
gold	[1:9]	270	6.91%
yellow	[10:29]	5	0.12%
greenyellow	[30:49]	14	0.35%
lawngreen	50+	1815	46.4%
All colors	3904	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2690	2690	9 : View List ['Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::vector >::size() const', 'std::__1::vector >::data()', 'std::__1::basic_string_view >::size() const', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr &&)', 'std::__1::vector >::~vector()']	2710	2721	Botan::EC_Group::EC_Group(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:407
1794	3408	21 : View List ['Botan::BigInt::ct_cond_add(bool, Botan::BigInt const&)', 'Botan::operator>>(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt const&)', 'Botan::BigInt::set_sign(Botan::BigInt::Sign)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::bits() const', 'Botan::BigInt::operator+=(Botan::BigInt const&)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::BigInt::is_negative() const', 'Botan::BigInt::get_bit(unsigned long) const', 'Botan::BigInt::zero()', 'Botan::BigInt::is_nonzero() const', 'Botan::BigInt::operator*=(Botan::BigInt const&)', 'Botan::operator*(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator-(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::mask_bits(unsigned long)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::(anonymous namespace)::inverse_mod_pow2(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::BigInt::ct_cond_assign(bool, Botan::BigInt const&)']	2392	4648	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:189
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
299	307	2 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']	299	576	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:194
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
157	157	13 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::OID::OID(std::__1::vector >&&)', 'std::__1::vector >::empty() const', 'Botan::(anonymous namespace)::parse_oid_str(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::vector >&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::~vector()', '__cxa_allocate_exception', 'Botan::Lookup_Error::Lookup_Error(std::__1::basic_string_view >)']	165	165	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:78
106	106	1 : View List ['Botan::bigint_monty_redc_16(unsigned long*, unsigned long const*, unsigned long, unsigned long*)']	106	106	Botan::bigint_monty_redc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:738
106	106	1 : View List ['Botan::bigint_monty_redc_24(unsigned long*, unsigned long const*, unsigned long, unsigned long*)']	106	106	Botan::bigint_monty_redc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:740
106	106	1 : View List ['Botan::bigint_monty_redc_32(unsigned long*, unsigned long const*, unsigned long, unsigned long*)']	106	106	Botan::bigint_monty_redc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:742
103	103	1 : View List ['Botan::EC_Point::force_affine()']	103	103	Botan::EC_Point::force_all_affine(std::__1::vector >&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:389
56	504	4 : View List ['Botan::OID::OID(std::initializer_list )', 'std::__1::shared_ptr ::shared_ptr()', 'Botan::OID::operator==(Botan::OID const&) const', 'Botan::OID::~OID()']	56	3472	Botan::EC_Group::EC_group_info(Botan::OIDconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_named.cpp:245
38	38	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Encoding_Error::Encoding_Error(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	38	38	Botan::BigInt::encode_words(unsignedlong*,unsignedlong)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:184

Runtime coverage analysis

Covered functions

470

Functions that are reachable but not covered

301

Reachable functions

916

Percentage of reachable functions covered

67.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/os2ecp.cpp	2
/src/botan/src/lib/pubkey/ec_group/ec_group.cpp	6
/src/botan/src/lib/asn1/asn1_oid.cpp	3
/src/botan/src/lib/utils/exceptn.cpp	3
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	3
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/asn1_obj.h	14
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	8
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/utils/parsing.cpp	1
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/utils/mem_ops.cpp	1
/src/botan/src/lib/pubkey/pem/pem.cpp	3
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/build/include/botan/data_src.h	4
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/internal/ct_utils.h	29
/src/botan/build/include/botan/internal/bit_ops.h	7
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/src/lib/asn1/ber_dec.cpp	17
/src/botan/src/lib/asn1/asn1_obj.cpp	7
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/internal/loadstor.h	3
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/build/include/botan/ber_dec.h	11
/src/botan/build/include/botan/bigint.h	60
/src/botan/src/lib/math/bigint/bigint.cpp	20
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/assert.h	2
/src/botan/src/lib/math/numbertheory/primality.cpp	3
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/mp_core.h	22
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	6
/src/botan/src/lib/math/bigint/big_ops2.cpp	8
/src/botan/build/include/botan/internal/mp_asmi.h	15
/src/botan/src/lib/math/bigint/big_ops3.cpp	8
/src/botan/src/lib/math/numbertheory/numthry.cpp	4
/src/botan/src/lib/math/numbertheory/monty_exp.cpp	6
/src/botan/build/include/botan/internal/monty.h	7
/src/botan/src/lib/math/numbertheory/monty.cpp	10
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/build/include/botan/reducer.h	3
/src/botan/src/lib/pubkey/ec_group/ec_point.cpp	7
/src/botan/build/include/botan/internal/monty_exp.h	1
/src/botan/build/include/botan/curve_gfp.h	14
/src/botan/build/include/botan/ec_point.h	3

Fuzzer: ressol

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2800	81.3%
gold	[1:9]	51	1.48%
yellow	[10:29]	12	0.34%
greenyellow	[30:49]	28	0.81%
lawngreen	50+	550	15.9%
All colors	3441	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
688	688	6 : View List ['Botan::bigint_monty_redc_8(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_24(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_32(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_6(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_16(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*)']	688	688	Botan::bigint_monty_redc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:732
304	360	22 : View List ['std::__1::unique_ptr >::operator bool() const', 'std::__1::basic_string_view >::empty() const', 'Botan::BlockCipher::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long const&)', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::arg(unsigned long) const', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)']	308	425	Botan::StreamCipher::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/stream/stream_cipher.cpp:86
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
273	1787	87 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	273	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:129
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
181	181	2 : View List ['Botan::(anonymous namespace)::karatsuba_sqr(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long)']	181	214	Botan::bigint_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:345
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
116	170	11 : View List ['__cxa_free_exception', '__cxa_throw', 'unsigned long Botan::high_bit (unsigned short)', 'Botan::RandomNumberGenerator::next_byte()', 'Botan::RandomNumberGenerator::randomize(unsigned char*, unsigned long)', 'Botan::BigInt::from_word(unsigned long)', 'Botan::operator!=(Botan::BigInt const&, unsigned long)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'unsigned int Botan::load_le (unsigned char const*, unsigned long)', 'Botan::Not_Implemented::Not_Implemented(std::__1::basic_string_view >)', '__cxa_allocate_exception']	116	170	Botan::random_prime(Botan::RandomNumberGenerator&,unsignedlong,Botan::BigIntconst&,unsignedlong,unsignedlong,unsignedlong)	call site: 00000	/src/botan/src/lib/math/numbertheory/make_prm.cpp:117
93	93	1 : View List ['Botan::ChaCha::chacha_avx512_x16(unsigned char*, unsigned int*, unsigned long)']	360	763	Botan::ChaCha::chacha(unsignedchar*,unsignedlong,unsignedint*,unsignedlong)	call site: 00000	/src/botan/src/lib/stream/chacha/chacha.cpp:115
38	38	5 : View List ['__cxa_free_exception', '__cxa_throw', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Internal_Error::Internal_Error(std::__1::basic_string_view >)', '__cxa_allocate_exception']	38	38	Botan::Montgomery_Int::fix_size()	call site: 00000	/src/botan/src/lib/math/numbertheory/monty.cpp:295
17	19	7 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::vector >::~vector()', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Buffered_Computation::~Buffered_Computation()', '__cxa_allocate_exception']	17	19	Botan::MDx_HashFunction::MDx_HashFunction(unsignedlong,bool,bool,unsignedchar)	call site: 00000	/src/botan/src/lib/hash/mdx_hash/mdx_hash.cpp:33
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73

Runtime coverage analysis

Covered functions

448

Functions that are reachable but not covered

171

Reachable functions

715

Percentage of reachable functions covered

76.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	3
/src/botan/./src/fuzzer/ressol.cpp	1
/src/botan/src/lib/math/bigint/bigint.cpp	21
/src/botan/build/include/botan/bigint.h	63
/src/botan/src/lib/math/numbertheory/make_prm.cpp	5
/src/botan/src/lib/utils/exceptn.cpp	6
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/ct_utils.h	26
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	7
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/internal/mp_core.h	22
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/build/include/botan/rng.h	6
/src/botan/build/include/botan/internal/loadstor.h	2
/src/botan/build/include/botan/mem_ops.h	6
/src/botan/src/lib/math/numbertheory/primality.cpp	4
/src/botan/src/lib/math/bigint/big_rand.cpp	2
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/math/bigint/big_ops3.cpp	9
/src/botan/src/lib/math/bigint/big_ops2.cpp	8
/src/botan/build/include/botan/internal/mp_asmi.h	15
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	6
/src/botan/src/lib/math/numbertheory/numthry.cpp	8
/src/botan/src/lib/math/numbertheory/monty_exp.cpp	6
/src/botan/build/include/botan/internal/monty.h	7
/src/botan/src/lib/math/numbertheory/monty.cpp	10
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/build/include/botan/reducer.h	3
/src/botan/build/include/botan/numthry.h	1
/src/botan/build/include/botan/internal/monty_exp.h	1
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3

Fuzzer: ecc_p384

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2989	71.4%
gold	[1:9]	271	6.47%
yellow	[10:29]	2	0.04%
greenyellow	[30:49]	66	1.57%
lawngreen	50+	855	20.4%
All colors	4183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2690	2690	9 : View List ['Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::vector >::size() const', 'std::__1::vector >::data()', 'std::__1::basic_string_view >::size() const', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr &&)', 'std::__1::vector >::~vector()']	2710	2721	Botan::EC_Group::EC_Group(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:407
582	582	5 : View List ['Botan::bigint_monty_redc_8(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_24(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_32(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_16(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*)']	582	582	Botan::bigint_monty_redc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:734
408	447	8 : View List ['std::__1::shared_ptr ::~shared_ptr()', 'std::__1::shared_ptr std::__1::make_shared (Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&)', 'std::__1::shared_ptr std::__1::make_shared (Botan::BigInt const&, Botan::BigInt const&)', 'std::__1::shared_ptr ::~shared_ptr()', 'Botan::operator==(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::prime_p521()', 'std::__1::shared_ptr ::shared_ptr (std::__1::shared_ptr &&)', 'std::__1::shared_ptr ::shared_ptr (std::__1::shared_ptr &&)']	408	447	Botan::CurveGFp::choose_repr(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/curve_gfp.cpp:574
304	360	22 : View List ['std::__1::unique_ptr >::operator bool() const', 'std::__1::basic_string_view >::empty() const', 'Botan::BlockCipher::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long const&)', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::arg(unsigned long) const', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)']	308	425	Botan::StreamCipher::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/stream/stream_cipher.cpp:86
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
290	6364	18 : View List ['Botan::operator<<(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::from_s32(int)', 'Botan::BigInt::operator=(Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::operator-(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::operator>>=(unsigned long)', 'Botan::jacobi(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::operator-=(unsigned long)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::Modular_Reducer::multiply(Botan::BigInt const&, Botan::BigInt const&) const', 'Botan::BigInt::from_word(unsigned long)', 'Botan::Modular_Reducer::square(Botan::BigInt const&) const', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::operator!=(Botan::BigInt const&, unsigned long)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::operator>(Botan::BigInt const&, unsigned long)']	302	8561	Botan::sqrt_modulo_prime(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/numthry.cpp:57
273	1787	87 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	273	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:129
224	2014	4 : View List ['Botan::OID::OID(std::initializer_list )', 'std::__1::shared_ptr ::shared_ptr()', 'Botan::OID::operator==(Botan::OID const&) const', 'Botan::OID::~OID()']	224	12614	Botan::EC_Group::EC_group_info(Botan::OIDconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_named.cpp:29
211	211	1 : View List ['Botan::EC_Point::negate()']	227	242	Botan::operator*(Botan::BigIntconst&,Botan::EC_Pointconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:378
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
181	181	2 : View List ['Botan::(anonymous namespace)::karatsuba_sqr(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long)']	181	214	Botan::bigint_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:345
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105

Runtime coverage analysis

Covered functions

589

Functions that are reachable but not covered

383

Reachable functions

1089

Percentage of reachable functions covered

64.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	3
/src/botan/./src/fuzzer/ecc_p384.cpp	1
/src/botan/src/lib/pubkey/ec_group/ec_group.cpp	11
/src/botan/src/lib/asn1/asn1_oid.cpp	3
/src/botan/src/lib/utils/exceptn.cpp	6
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	3
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/asn1_obj.h	14
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	9
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/utils/parsing.cpp	1
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/utils/mem_ops.cpp	1
/src/botan/src/lib/pubkey/pem/pem.cpp	3
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/build/include/botan/data_src.h	4
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/internal/ct_utils.h	31
/src/botan/build/include/botan/internal/bit_ops.h	7
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/src/lib/asn1/ber_dec.cpp	17
/src/botan/src/lib/asn1/asn1_obj.cpp	7
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/internal/loadstor.h	3
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/build/include/botan/ber_dec.h	11
/src/botan/build/include/botan/bigint.h	62
/src/botan/src/lib/math/bigint/bigint.cpp	25
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/assert.h	3
/src/botan/src/lib/math/numbertheory/primality.cpp	3
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/mp_core.h	26
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	6
/src/botan/src/lib/math/bigint/big_ops2.cpp	11
/src/botan/build/include/botan/internal/mp_asmi.h	15
/src/botan/src/lib/math/bigint/big_ops3.cpp	8
/src/botan/src/lib/math/numbertheory/numthry.cpp	4
/src/botan/src/lib/math/numbertheory/monty_exp.cpp	6
/src/botan/build/include/botan/internal/monty.h	7
/src/botan/src/lib/math/numbertheory/monty.cpp	10
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/build/include/botan/reducer.h	3
/src/botan/src/lib/pubkey/ec_group/ec_point.cpp	14
/src/botan/build/include/botan/internal/monty_exp.h	1
/src/botan/./src/fuzzer/ecc_helper.h	3
/src/botan/build/include/botan/ec_point.h	19
/src/botan/build/include/botan/curve_gfp.h	25
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/src/botan/src/lib/pubkey/ec_group/point_mul.cpp	3
/src/botan/src/lib/math/bigint/big_rand.cpp	1
/src/botan/build/include/botan/rng.h	4
/src/botan/build/include/botan/internal/point_mul.h	1

Fuzzer: ecc_p521

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2675	63.9%
gold	[1:9]	529	12.6%
yellow	[10:29]	1	0.02%
greenyellow	[30:49]	2	0.04%
lawngreen	50+	976	23.3%
All colors	4183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2690	2690	9 : View List ['Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::vector >::size() const', 'std::__1::vector >::data()', 'std::__1::basic_string_view >::size() const', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr &&)', 'std::__1::vector >::~vector()']	2710	2721	Botan::EC_Group::EC_Group(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:407
304	360	22 : View List ['std::__1::unique_ptr >::operator bool() const', 'std::__1::basic_string_view >::empty() const', 'Botan::BlockCipher::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long const&)', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::arg(unsigned long) const', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)']	308	425	Botan::StreamCipher::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/stream/stream_cipher.cpp:86
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
290	6364	18 : View List ['Botan::operator<<(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::from_s32(int)', 'Botan::BigInt::operator=(Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::operator-(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::operator>>=(unsigned long)', 'Botan::jacobi(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::operator-=(unsigned long)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::Modular_Reducer::multiply(Botan::BigInt const&, Botan::BigInt const&) const', 'Botan::BigInt::from_word(unsigned long)', 'Botan::Modular_Reducer::square(Botan::BigInt const&) const', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::operator!=(Botan::BigInt const&, unsigned long)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::operator>(Botan::BigInt const&, unsigned long)']	302	8561	Botan::sqrt_modulo_prime(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/numthry.cpp:57
273	1787	87 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	273	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:129
216	1942	4 : View List ['Botan::OID::OID(std::initializer_list )', 'std::__1::shared_ptr ::shared_ptr()', 'Botan::OID::operator==(Botan::OID const&) const', 'Botan::OID::~OID()']	216	12118	Botan::EC_Group::EC_group_info(Botan::OIDconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_named.cpp:41
211	211	1 : View List ['Botan::EC_Point::negate()']	227	242	Botan::operator*(Botan::BigIntconst&,Botan::EC_Pointconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:378
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
157	157	13 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::OID::OID(std::__1::vector >&&)', 'std::__1::vector >::empty() const', 'Botan::(anonymous namespace)::parse_oid_str(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::vector >&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::~vector()', '__cxa_allocate_exception', 'Botan::Lookup_Error::Lookup_Error(std::__1::basic_string_view >)']	165	165	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:78
121	121	1 : View List ['void Botan::bigint_mod_sub_n<4ul>(unsigned long*, unsigned long const*, unsigned long const*, unsigned long*)']	121	135	Botan::BigInt::mod_sub(Botan::BigIntconst&,Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops2.cpp:108
121	121	1 : View List ['void Botan::bigint_mod_sub_n<6ul>(unsigned long*, unsigned long const*, unsigned long const*, unsigned long*)']	121	135	Botan::BigInt::mod_sub(Botan::BigIntconst&,Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops2.cpp:110

Runtime coverage analysis

Covered functions

584

Functions that are reachable but not covered

385

Reachable functions

1089

Percentage of reachable functions covered

64.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	3
/src/botan/./src/fuzzer/ecc_p521.cpp	1
/src/botan/src/lib/pubkey/ec_group/ec_group.cpp	11
/src/botan/src/lib/asn1/asn1_oid.cpp	3
/src/botan/src/lib/utils/exceptn.cpp	6
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	3
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/asn1_obj.h	14
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	9
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/utils/parsing.cpp	1
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/utils/mem_ops.cpp	1
/src/botan/src/lib/pubkey/pem/pem.cpp	3
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/build/include/botan/data_src.h	4
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/internal/ct_utils.h	31
/src/botan/build/include/botan/internal/bit_ops.h	7
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/src/lib/asn1/ber_dec.cpp	17
/src/botan/src/lib/asn1/asn1_obj.cpp	7
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/internal/loadstor.h	3
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/build/include/botan/ber_dec.h	11
/src/botan/build/include/botan/bigint.h	62
/src/botan/src/lib/math/bigint/bigint.cpp	25
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/assert.h	3
/src/botan/src/lib/math/numbertheory/primality.cpp	3
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/mp_core.h	26
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	6
/src/botan/src/lib/math/bigint/big_ops2.cpp	11
/src/botan/build/include/botan/internal/mp_asmi.h	15
/src/botan/src/lib/math/bigint/big_ops3.cpp	8
/src/botan/src/lib/math/numbertheory/numthry.cpp	4
/src/botan/src/lib/math/numbertheory/monty_exp.cpp	6
/src/botan/build/include/botan/internal/monty.h	7
/src/botan/src/lib/math/numbertheory/monty.cpp	10
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/build/include/botan/reducer.h	3
/src/botan/src/lib/pubkey/ec_group/ec_point.cpp	14
/src/botan/build/include/botan/internal/monty_exp.h	1
/src/botan/./src/fuzzer/ecc_helper.h	3
/src/botan/build/include/botan/ec_point.h	19
/src/botan/build/include/botan/curve_gfp.h	25
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/src/botan/src/lib/pubkey/ec_group/point_mul.cpp	3
/src/botan/src/lib/math/bigint/big_rand.cpp	1
/src/botan/build/include/botan/rng.h	4
/src/botan/build/include/botan/internal/point_mul.h	1

Fuzzer: ecc_bp256

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3024	72.2%
gold	[1:9]	271	6.47%
yellow	[10:29]	3	0.07%
greenyellow	[30:49]	66	1.57%
lawngreen	50+	819	19.5%
All colors	4183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2690	2690	9 : View List ['Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::vector >::size() const', 'std::__1::vector >::data()', 'std::__1::basic_string_view >::size() const', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr &&)', 'std::__1::vector >::~vector()']	2710	2721	Botan::EC_Group::EC_Group(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:407
1794	3408	21 : View List ['Botan::BigInt::ct_cond_add(bool, Botan::BigInt const&)', 'Botan::operator>>(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt const&)', 'Botan::BigInt::set_sign(Botan::BigInt::Sign)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::bits() const', 'Botan::BigInt::operator+=(Botan::BigInt const&)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::BigInt::is_negative() const', 'Botan::BigInt::get_bit(unsigned long) const', 'Botan::BigInt::zero()', 'Botan::BigInt::is_nonzero() const', 'Botan::BigInt::operator*=(Botan::BigInt const&)', 'Botan::operator*(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator-(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::mask_bits(unsigned long)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::(anonymous namespace)::inverse_mod_pow2(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::BigInt::ct_cond_assign(bool, Botan::BigInt const&)']	2392	4648	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:189
688	688	6 : View List ['Botan::bigint_monty_redc_8(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_24(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_32(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_6(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_16(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*)']	688	688	Botan::bigint_monty_redc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:732
304	360	22 : View List ['std::__1::unique_ptr >::operator bool() const', 'std::__1::basic_string_view >::empty() const', 'Botan::BlockCipher::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long const&)', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::arg(unsigned long) const', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)']	308	425	Botan::StreamCipher::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/stream/stream_cipher.cpp:86
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
299	307	2 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']	299	576	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:194
290	6364	18 : View List ['Botan::operator<<(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::from_s32(int)', 'Botan::BigInt::operator=(Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::operator-(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::operator>>=(unsigned long)', 'Botan::jacobi(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::operator-=(unsigned long)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::Modular_Reducer::multiply(Botan::BigInt const&, Botan::BigInt const&) const', 'Botan::BigInt::from_word(unsigned long)', 'Botan::Modular_Reducer::square(Botan::BigInt const&) const', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::operator!=(Botan::BigInt const&, unsigned long)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::operator>(Botan::BigInt const&, unsigned long)']	302	8561	Botan::sqrt_modulo_prime(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/numthry.cpp:57
273	1787	87 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	273	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:129
211	211	1 : View List ['Botan::EC_Point::negate()']	227	242	Botan::operator*(Botan::BigIntconst&,Botan::EC_Pointconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:378
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
184	1654	4 : View List ['Botan::OID::OID(std::initializer_list )', 'std::__1::shared_ptr ::shared_ptr()', 'Botan::OID::operator==(Botan::OID const&) const', 'Botan::OID::~OID()']	184	10134	Botan::EC_Group::EC_group_info(Botan::OIDconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_named.cpp:89
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105

Runtime coverage analysis

Covered functions

584

Functions that are reachable but not covered

399

Reachable functions

1089

Percentage of reachable functions covered

63.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	3
/src/botan/./src/fuzzer/ecc_bp256.cpp	1
/src/botan/src/lib/pubkey/ec_group/ec_group.cpp	11
/src/botan/src/lib/asn1/asn1_oid.cpp	3
/src/botan/src/lib/utils/exceptn.cpp	6
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	3
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/asn1_obj.h	14
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	9
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/utils/parsing.cpp	1
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/utils/mem_ops.cpp	1
/src/botan/src/lib/pubkey/pem/pem.cpp	3
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/build/include/botan/data_src.h	4
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/internal/ct_utils.h	31
/src/botan/build/include/botan/internal/bit_ops.h	7
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/src/lib/asn1/ber_dec.cpp	17
/src/botan/src/lib/asn1/asn1_obj.cpp	7
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/internal/loadstor.h	3
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/build/include/botan/ber_dec.h	11
/src/botan/build/include/botan/bigint.h	62
/src/botan/src/lib/math/bigint/bigint.cpp	25
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/assert.h	3
/src/botan/src/lib/math/numbertheory/primality.cpp	3
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/mp_core.h	26
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	6
/src/botan/src/lib/math/bigint/big_ops2.cpp	11
/src/botan/build/include/botan/internal/mp_asmi.h	15
/src/botan/src/lib/math/bigint/big_ops3.cpp	8
/src/botan/src/lib/math/numbertheory/numthry.cpp	4
/src/botan/src/lib/math/numbertheory/monty_exp.cpp	6
/src/botan/build/include/botan/internal/monty.h	7
/src/botan/src/lib/math/numbertheory/monty.cpp	10
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/build/include/botan/reducer.h	3
/src/botan/src/lib/pubkey/ec_group/ec_point.cpp	14
/src/botan/build/include/botan/internal/monty_exp.h	1
/src/botan/./src/fuzzer/ecc_helper.h	3
/src/botan/build/include/botan/ec_point.h	19
/src/botan/build/include/botan/curve_gfp.h	25
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/src/botan/src/lib/pubkey/ec_group/point_mul.cpp	3
/src/botan/src/lib/math/bigint/big_rand.cpp	1
/src/botan/build/include/botan/rng.h	4
/src/botan/build/include/botan/internal/point_mul.h	1

Fuzzer: ecc_p256

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3018	72.1%
gold	[1:9]	271	6.47%
yellow	[10:29]	107	2.55%
greenyellow	[30:49]	4	0.09%
lawngreen	50+	783	18.7%
All colors	4183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2690	2690	9 : View List ['Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::vector >::size() const', 'std::__1::vector >::data()', 'std::__1::basic_string_view >::size() const', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr &&)', 'std::__1::vector >::~vector()']	2710	2721	Botan::EC_Group::EC_Group(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:407
816	894	12 : View List ['std::__1::shared_ptr ::~shared_ptr()', 'std::__1::shared_ptr ::~shared_ptr()', 'std::__1::shared_ptr std::__1::make_shared (Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&)', 'std::__1::shared_ptr std::__1::make_shared (Botan::BigInt const&, Botan::BigInt const&)', 'Botan::prime_p384()', 'std::__1::shared_ptr ::~shared_ptr()', 'std::__1::shared_ptr std::__1::make_shared (Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, Botan::BigInt const&)', 'std::__1::shared_ptr ::shared_ptr (std::__1::shared_ptr &&)', 'Botan::prime_p521()', 'std::__1::shared_ptr ::shared_ptr (std::__1::shared_ptr &&)', 'std::__1::shared_ptr ::shared_ptr (std::__1::shared_ptr &&)']	816	894	Botan::CurveGFp::choose_repr(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/curve_gfp.cpp:571
688	688	6 : View List ['Botan::bigint_monty_redc_8(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_24(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_32(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_6(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_16(unsigned long*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*)']	688	688	Botan::bigint_monty_redc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/mp_core.h:732
304	360	22 : View List ['std::__1::unique_ptr >::operator bool() const', 'std::__1::basic_string_view >::empty() const', 'Botan::BlockCipher::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long const&)', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::arg(unsigned long) const', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)']	308	425	Botan::StreamCipher::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/stream/stream_cipher.cpp:86
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
290	6364	18 : View List ['Botan::operator<<(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::from_s32(int)', 'Botan::BigInt::operator=(Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::operator-(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::operator>>=(unsigned long)', 'Botan::jacobi(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::operator-=(unsigned long)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::Modular_Reducer::multiply(Botan::BigInt const&, Botan::BigInt const&) const', 'Botan::BigInt::from_word(unsigned long)', 'Botan::Modular_Reducer::square(Botan::BigInt const&) const', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::operator!=(Botan::BigInt const&, unsigned long)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::operator>(Botan::BigInt const&, unsigned long)']	302	8561	Botan::sqrt_modulo_prime(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/numthry.cpp:57
273	1787	87 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	273	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:129
232	2086	4 : View List ['Botan::OID::OID(std::initializer_list )', 'std::__1::shared_ptr ::shared_ptr()', 'Botan::OID::operator==(Botan::OID const&) const', 'Botan::OID::~OID()']	232	13110	Botan::EC_Group::EC_group_info(Botan::OIDconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_named.cpp:17
211	211	1 : View List ['Botan::EC_Point::negate()']	227	242	Botan::operator*(Botan::BigIntconst&,Botan::EC_Pointconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:378
191	191	2 : View List ['Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)', 'Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)']	191	224	Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong)	call site: 00000	/src/botan/src/lib/math/mp/mp_karat.cpp:310
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
157	157	13 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::OID::OID(std::__1::vector >&&)', 'std::__1::vector >::empty() const', 'Botan::(anonymous namespace)::parse_oid_str(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::vector >&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::~vector()', '__cxa_allocate_exception', 'Botan::Lookup_Error::Lookup_Error(std::__1::basic_string_view >)']	165	165	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:78

Runtime coverage analysis

Covered functions

581

Functions that are reachable but not covered

397

Reachable functions

1089

Percentage of reachable functions covered

63.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	3
/src/botan/./src/fuzzer/ecc_p256.cpp	1
/src/botan/src/lib/pubkey/ec_group/ec_group.cpp	11
/src/botan/src/lib/asn1/asn1_oid.cpp	3
/src/botan/src/lib/utils/exceptn.cpp	6
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	3
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/asn1_obj.h	14
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/fmt.h	9
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/utils/parsing.cpp	1
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/src/lib/utils/mem_ops.cpp	1
/src/botan/src/lib/pubkey/pem/pem.cpp	3
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/build/include/botan/data_src.h	4
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/internal/ct_utils.h	31
/src/botan/build/include/botan/internal/bit_ops.h	7
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/src/lib/asn1/ber_dec.cpp	17
/src/botan/src/lib/asn1/asn1_obj.cpp	7
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/internal/loadstor.h	3
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/build/include/botan/ber_dec.h	11
/src/botan/build/include/botan/bigint.h	62
/src/botan/src/lib/math/bigint/bigint.cpp	25
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/assert.h	3
/src/botan/src/lib/math/numbertheory/primality.cpp	3
/src/botan/src/lib/math/numbertheory/reducer.cpp	4
/src/botan/build/include/botan/internal/mp_core.h	26
/src/botan/build/include/botan/internal/divide.h	1
/src/botan/src/lib/math/bigint/divide.cpp	6
/src/botan/src/lib/math/bigint/big_ops2.cpp	11
/src/botan/build/include/botan/internal/mp_asmi.h	15
/src/botan/src/lib/math/bigint/big_ops3.cpp	8
/src/botan/src/lib/math/numbertheory/numthry.cpp	4
/src/botan/src/lib/math/numbertheory/monty_exp.cpp	6
/src/botan/build/include/botan/internal/monty.h	7
/src/botan/src/lib/math/numbertheory/monty.cpp	10
/src/botan/src/lib/math/mp/mp_karat.cpp	20
/src/botan/src/lib/math/mp/mp_comba.cpp	12
/src/botan/src/lib/math/mp/mp_monty_n.cpp	6
/src/botan/src/lib/math/mp/mp_monty.cpp	1
/src/botan/build/include/botan/reducer.h	3
/src/botan/src/lib/pubkey/ec_group/ec_point.cpp	14
/src/botan/build/include/botan/internal/monty_exp.h	1
/src/botan/./src/fuzzer/ecc_helper.h	3
/src/botan/build/include/botan/ec_point.h	19
/src/botan/build/include/botan/curve_gfp.h	25
/src/botan/src/lib/math/bigint/big_io.cpp	1
/src/botan/src/lib/math/bigint/big_code.cpp	2
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/src/botan/src/lib/pubkey/ec_group/point_mul.cpp	3
/src/botan/src/lib/math/bigint/big_rand.cpp	1
/src/botan/build/include/botan/rng.h	4
/src/botan/build/include/botan/internal/point_mul.h	1

Fuzzer: pkcs8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	272	33.7%
gold	[1:9]	262	32.5%
yellow	[10:29]	37	4.59%
greenyellow	[30:49]	8	0.99%
lawngreen	50+	226	28.0%
All colors	805	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2652	3868	12 : View List ['std::__1::span ::span >&>(std::__1::vector >&)', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'Botan::AlgorithmIdentifier::parameters() const', 'std::__1::basic_string , std::__1::allocator > Botan::fmt (std::__1::basic_string_view >, Botan::OID const&)', 'Botan::pbes2_decrypt(std::__1::span , std::__1::basic_string_view >, std::__1::vector > const&)', 'Botan::OID::to_formatted_string() const', 'std::__1::function , std::__1::allocator > ()>::operator()() const', 'Botan::PKCS8_Exception::PKCS8_Exception(std::__1::basic_string_view >)', 'Botan::AlgorithmIdentifier::oid() const', 'bool std::__1::operator!= , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::operator=(std::__1::vector >&&)']	2696	5077	Botan::PKCS8::(anonymousnamespace)::PKCS8_decode(Botan::DataSource&,std::__1::function ,std::__1::allocator >()>const&,Botan::AlgorithmIdentifier&,bool)	call site: 00000	/src/botan/src/lib/pubkey/pkcs8.cpp:85
1443	3408	21 : View List ['Botan::BigInt::ct_cond_add(bool, Botan::BigInt const&)', 'Botan::operator>>(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt const&)', 'Botan::BigInt::set_sign(Botan::BigInt::Sign)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::bits() const', 'Botan::BigInt::operator+=(Botan::BigInt const&)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::BigInt::is_negative() const', 'Botan::BigInt::get_bit(unsigned long) const', 'Botan::BigInt::zero()', 'Botan::BigInt::is_nonzero() const', 'Botan::BigInt::operator*=(Botan::BigInt const&)', 'Botan::operator*(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator-(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::mask_bits(unsigned long)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::(anonymous namespace)::inverse_mod_pow2(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::BigInt::ct_cond_assign(bool, Botan::BigInt const&)']	2041	4648	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:189
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
299	307	2 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']	299	576	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:194
211	211	1 : View List ['Botan::EC_Point::negate()']	227	242	Botan::operator*(Botan::BigIntconst&,Botan::EC_Pointconst&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:378
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
119	615	7 : View List ['bool std::__1::operator!= (std::__1::shared_ptr const&, decltype(nullptr))', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'std::__1::shared_ptr ::operator*() const', 'Botan::EC_Group_Data::set_oid(Botan::OID const&)', 'Botan::EC_Group_Data::params_match(Botan::EC_Group_Data const&) const', 'Botan::EC_Group::EC_group_info(Botan::OID const&)', 'std::__1::shared_ptr ::operator->() const']	127	623	Botan::EC_Group_Data_Map::lookup_or_create(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::OIDconst&,Botan::EC_Group_Source)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:259
103	103	1 : View List ['Botan::EC_Point::force_affine()']	103	103	Botan::EC_Point::force_all_affine(std::__1::vector >&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:389
38	38	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Encoding_Error::Encoding_Error(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	38	38	Botan::BigInt::encode_words(unsignedlong*,unsignedlong)const	call site: 00000	/src/botan/src/lib/math/bigint/bigint.cpp:184
26	26	1 : View List ['Botan::EC_Group::inverse_mod_order(Botan::BigInt const&) const']	50	980	Botan::EC_PrivateKey::EC_PrivateKey(Botan::AlgorithmIdentifierconst&,std::__1::span ,bool)	call site: 00000	/src/botan/src/lib/pubkey/ecc_key/ecc_key.cpp:139
8	300	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object&&)', 'Botan::BER_Decoder::verify_end()', 'Botan::BER_Decoder& Botan::BER_Decoder::decode >(std::__1::vector >&, Botan::ASN1_Type)']	12	304	Botan::BER_Decoder&Botan::BER_Decoder::decode_optional_string >(std::__1::vector >&,Botan::ASN1_Type,unsignedint,Botan::ASN1_Class)	call site: 00000	/src/botan/build/include/botan/ber_dec.h:277
6	31	7 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	6	31	Botan::split_on(std::__1::basic_string_view >,char)	call site: 00000	/src/botan/src/lib/utils/parsing.cpp:129

Runtime coverage analysis

Covered functions

843

Functions that are reachable but not covered

136

Reachable functions

499

Percentage of reachable functions covered

72.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/pkcs8.cpp	1
/src/botan/build/include/botan/data_src.h	5
/src/botan/src/lib/pubkey/pkcs8.cpp	4
/src/botan/build/include/botan/asn1_obj.h	19
/src/botan/src/lib/asn1/asn1_obj.cpp	8
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/src/lib/utils/exceptn.cpp	12
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	11
/src/botan/build/include/botan/exceptn.h	3
/src/botan/src/lib/pubkey/pem/pem.cpp	2
/src/botan/src/lib/asn1/ber_dec.cpp	18
/src/botan/build/include/botan/ber_dec.h	8
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/internal/loadstor.h	3
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/mem_ops.h	6
/src/botan/build/include/botan/internal/ct_utils.h	9
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/pkcs8.h	1
/src/botan/src/lib/asn1/asn1_oid.cpp	6
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/pubkey/pbes2/pbes2.cpp	3
/src/botan/src/lib/utils/parsing.cpp	3
/src/botan/src/lib/modes/cipher_mode.cpp	1
/src/botan/src/lib/stream/stream_cipher.cpp	1
/src/botan/src/lib/utils/scan_name.cpp	6
/src/botan/build/include/botan/internal/scan_name.h	4
/src/botan/src/lib/block/block_cipher.cpp	1
/src/botan/src/lib/hash/hash.cpp	1
/src/botan/build/include/botan/assert.h	4
/src/botan/src/lib/modes/aead/aead.cpp	1
/src/botan/src/lib/modes/mode_pad/mode_pad.cpp	1
/src/botan/build/include/botan/sym_algo.h	1
/src/botan/build/include/botan/bigint.h	19
/src/botan/src/lib/math/bigint/bigint.cpp	6
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/asn1/alg_id.cpp	1
/src/botan/src/lib/pbkdf/pwdhash.cpp	2
/src/botan/src/lib/mac/mac.cpp	1
/src/botan/build/include/botan/pwdhash.h	1
/src/botan/build/include/botan/cipher_mode.h	2
/src/botan/src/lib/pubkey/pk_algs.cpp	1
/src/botan/src/lib/pubkey/ec_group/ec_group.cpp	3
/src/botan/src/lib/utils/mem_ops.cpp	1

Fuzzer: crl

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	13.7%
gold	[1:9]	6	4.83%
yellow	[10:29]	9	7.25%
greenyellow	[30:49]	8	6.45%
lawngreen	50+	84	67.7%
All colors	124	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
331	376	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::decode(bool&)', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object&&)', 'Botan::BER_Decoder::verify_end()']	335	380	Botan::BER_Decoder&Botan::BER_Decoder::decode_optional (bool&,Botan::ASN1_Type,Botan::ASN1_Class,boolconst&)	call site: 00000	/src/botan/build/include/botan/ber_dec.h:317
79	157	13 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::OID::OID(std::__1::vector >&&)', 'std::__1::vector >::empty() const', 'Botan::(anonymous namespace)::parse_oid_str(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::vector >&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::~vector()', '__cxa_allocate_exception', 'Botan::Lookup_Error::Lookup_Error(std::__1::basic_string_view >)']	87	165	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:78
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BER_Decoder::push_back(Botan::BER_Objectconst&)	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:271
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BER_Decoder::push_back(Botan::BER_Object&&)	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:278
17	17	5 : View List ['__cxa_throw', '__cxa_free_exception', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Cert_Extension::CRL_Number::get_crl_number()const	call site: 00000	/src/botan/src/lib/x509/x509_ext.cpp:664
11	11	1 : View List ['Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)']	17	17	Botan::BER_Decoder::end_cons()	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:294
8	562	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object&&)', 'Botan::BER_Decoder::verify_end()', 'Botan::BER_Decoder::decode(unsigned long&)']	12	566	Botan::BER_Decoder&Botan::BER_Decoder::decode_optional (unsignedlong&,Botan::ASN1_Type,Botan::ASN1_Class,unsignedlongconst&)	call site: 00000	/src/botan/build/include/botan/ber_dec.h:317
8	300	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object&&)', 'Botan::BER_Decoder::verify_end()', 'Botan::BER_Decoder& Botan::BER_Decoder::decode >(std::__1::vector >&, Botan::ASN1_Type)']	12	304	Botan::BER_Decoder&Botan::BER_Decoder::decode_optional_string >(std::__1::vector >&,Botan::ASN1_Type,unsignedint,Botan::ASN1_Class)	call site: 00000	/src/botan/build/include/botan/ber_dec.h:277
6	17	7 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, char const*)', '__cxa_allocate_exception', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator > const&)']	6	17	Botan::to_u32bit(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/utils/parsing.cpp:46
0	11	1 : View List ['Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']	6	17	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:73
0	4	1 : View List ['Botan::OID::OID()']	0	4	Botan::OID_Map::str2oid(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/oid_map.cpp:72
0	0	None	16	320	Botan::BER_Decoder::get_next_object()	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:253

Runtime coverage analysis

Covered functions

382

Functions that are reachable but not covered

26

Reachable functions

148

Percentage of reachable functions covered

82.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/crl.cpp	1
/src/botan/build/include/botan/data_src.h	5
/src/botan/src/lib/x509/x509_crl.cpp	1
/src/botan/build/include/botan/x509_obj.h	2
/src/botan/build/include/botan/asn1_obj.h	6
/src/botan/src/lib/x509/x509_obj.cpp	1
/src/botan/src/lib/asn1/asn1_obj.cpp	1
/src/botan/src/lib/utils/data_src.cpp	2
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/src/lib/utils/exceptn.cpp	8
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	7
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/pubkey/pem/pem.cpp	2
/src/botan/src/lib/asn1/ber_dec.cpp	1
/src/botan/build/include/botan/ber_dec.h	1
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/build/include/botan/internal/ct_utils.h	7
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/x509_crl.h	1

Fuzzer: cert

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	11.2%
gold	[1:9]	9	7.25%
yellow	[10:29]	10	8.06%
greenyellow	[30:49]	2	1.61%
lawngreen	50+	89	71.7%
All colors	124	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1443	3408	21 : View List ['Botan::BigInt::ct_cond_add(bool, Botan::BigInt const&)', 'Botan::operator>>(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt const&)', 'Botan::BigInt::set_sign(Botan::BigInt::Sign)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::bits() const', 'Botan::BigInt::operator+=(Botan::BigInt const&)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::BigInt::is_negative() const', 'Botan::BigInt::get_bit(unsigned long) const', 'Botan::BigInt::zero()', 'Botan::BigInt::is_nonzero() const', 'Botan::BigInt::operator*=(Botan::BigInt const&)', 'Botan::operator*(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator-(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::mask_bits(unsigned long)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::(anonymous namespace)::inverse_mod_pow2(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::BigInt::ct_cond_assign(bool, Botan::BigInt const&)']	2041	4648	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:189
629	631	10 : View List ['Botan::SHA1_F::(anonymous namespace)::F2(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'void Botan::load_be (unsigned int*, unsigned char const*, unsigned long)', 'Botan::SHA1_F::(anonymous namespace)::F4(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'unsigned int Botan::rotl<1ul, unsigned int>(unsigned int)', 'std::__1::vector >::operator[](unsigned long)', 'Botan::MDx_HashFunction::hash_block_size() const', 'Botan::SHA1_F::(anonymous namespace)::F1(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::data()', 'Botan::SHA1_F::(anonymous namespace)::F3(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::resize(unsigned long)']	629	631	Botan::SHA_1::compress_n(unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/hash/sha1/sha1.cpp:78
331	376	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::decode(bool&)', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object&&)', 'Botan::BER_Decoder::verify_end()']	335	380	Botan::BER_Decoder&Botan::BER_Decoder::decode_optional (bool&,Botan::ASN1_Type,Botan::ASN1_Class,boolconst&)	call site: 00000	/src/botan/build/include/botan/ber_dec.h:317
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
299	307	2 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']	299	576	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:194
268	1787	51 : View List ['std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::arg_count() const', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::operator bool() const']	268	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:197
211	211	1 : View List ['Botan::EC_Point::negate()']	227	246	Botan::EC_Point_Multi_Point_Precompute::multi_exp(Botan::BigIntconst&,Botan::BigIntconst&)const	call site: 00000	/src/botan/src/lib/pubkey/ec_group/point_mul.cpp:377
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
103	103	1 : View List ['Botan::EC_Point::force_affine()']	103	103	Botan::EC_Point::force_all_affine(std::__1::vector >&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:389
68	157	13 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::OID::OID(std::__1::vector >&&)', 'std::__1::vector >::empty() const', 'Botan::(anonymous namespace)::parse_oid_str(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::vector >&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::~vector()', '__cxa_allocate_exception', 'Botan::Lookup_Error::Lookup_Error(std::__1::basic_string_view >)']	76	165	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:78
64	615	7 : View List ['bool std::__1::operator!= (std::__1::shared_ptr const&, decltype(nullptr))', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'std::__1::shared_ptr ::operator*() const', 'Botan::EC_Group_Data::set_oid(Botan::OID const&)', 'Botan::EC_Group_Data::params_match(Botan::EC_Group_Data const&) const', 'Botan::EC_Group::EC_group_info(Botan::OID const&)', 'std::__1::shared_ptr ::operator->() const']	72	623	Botan::EC_Group_Data_Map::lookup_or_create(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&,Botan::OIDconst&,Botan::EC_Group_Source)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:259
16	69	3 : View List ['Botan::EC_Point::operator=(Botan::EC_Point&&)', 'Botan::EC_Point::~EC_Point()', 'Botan::EC_Point::EC_Point(Botan::CurveGFp const&)']	16	69	Botan::EC_Point::mult2i(unsignedlong,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:241

Runtime coverage analysis

Covered functions

1279

Functions that are reachable but not covered

22

Reachable functions

148

Percentage of reachable functions covered

85.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/cert.cpp	1
/src/botan/build/include/botan/data_src.h	5
/src/botan/src/lib/x509/x509cert.cpp	1
/src/botan/build/include/botan/x509_obj.h	2
/src/botan/build/include/botan/asn1_obj.h	6
/src/botan/src/lib/x509/x509_obj.cpp	1
/src/botan/src/lib/asn1/asn1_obj.cpp	1
/src/botan/src/lib/utils/data_src.cpp	2
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/src/lib/utils/exceptn.cpp	8
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	7
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/pubkey/pem/pem.cpp	2
/src/botan/src/lib/asn1/ber_dec.cpp	1
/src/botan/build/include/botan/ber_dec.h	1
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/build/include/botan/internal/ct_utils.h	7
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/x509cert.h	1

Fuzzer: ocsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	45	11.1%
gold	[1:9]	7	1.74%
yellow	[10:29]	17	4.22%
greenyellow	[30:49]	19	4.72%
lawngreen	50+	314	78.1%
All colors	402	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
629	631	10 : View List ['Botan::SHA1_F::(anonymous namespace)::F2(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'void Botan::load_be (unsigned int*, unsigned char const*, unsigned long)', 'Botan::SHA1_F::(anonymous namespace)::F4(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'unsigned int Botan::rotl<1ul, unsigned int>(unsigned int)', 'std::__1::vector >::operator[](unsigned long)', 'Botan::MDx_HashFunction::hash_block_size() const', 'Botan::SHA1_F::(anonymous namespace)::F1(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::data()', 'Botan::SHA1_F::(anonymous namespace)::F3(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::resize(unsigned long)']	629	631	Botan::SHA_1::compress_n(unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/hash/sha1/sha1.cpp:78
517	1787	69 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	517	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:161
331	376	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::decode(bool&)', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object&&)', 'Botan::BER_Decoder::verify_end()']	335	380	Botan::BER_Decoder&Botan::BER_Decoder::decode_optional (bool&,Botan::ASN1_Type,Botan::ASN1_Class,boolconst&)	call site: 00000	/src/botan/build/include/botan/ber_dec.h:317
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
79	157	13 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::OID::OID(std::__1::vector >&&)', 'std::__1::vector >::empty() const', 'Botan::(anonymous namespace)::parse_oid_str(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::vector >&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::~vector()', '__cxa_allocate_exception', 'Botan::Lookup_Error::Lookup_Error(std::__1::basic_string_view >)']	87	165	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:78
62	69	2 : View List ['Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'unsigned long Botan::high_bit (unsigned int)']	62	69	Botan::(anonymousnamespace)::encode_tag(std::__1::vector >&,Botan::ASN1_Type,Botan::ASN1_Class)	call site: 00000	/src/botan/src/lib/asn1/der_enc.cpp:32
38	38	5 : View List ['__cxa_free_exception', '__cxa_throw', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Internal_Error::Internal_Error(std::__1::basic_string_view >)', '__cxa_allocate_exception']	38	38	Botan::Montgomery_Int::fix_size()	call site: 00000	/src/botan/src/lib/math/numbertheory/monty.cpp:295
17	19	7 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::vector >::~vector()', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Buffered_Computation::~Buffered_Computation()', '__cxa_allocate_exception']	17	19	Botan::MDx_HashFunction::MDx_HashFunction(unsignedlong,bool,bool,unsignedchar)	call site: 00000	/src/botan/src/lib/hash/mdx_hash/mdx_hash.cpp:33
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BER_Decoder::push_back(Botan::BER_Objectconst&)	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:271
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::BER_Decoder::push_back(Botan::BER_Object&&)	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:278
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::DER_Encoder::end_cons()	call site: 00000	/src/botan/src/lib/asn1/der_enc.cpp:170
17	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	17	17	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:73

Runtime coverage analysis

Covered functions

865

Functions that are reachable but not covered

53

Reachable functions

400

Percentage of reachable functions covered

86.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/ocsp.cpp	1
/src/botan/src/lib/x509/ocsp.cpp	2
/src/botan/build/include/botan/asn1_obj.h	20
/src/botan/build/include/botan/pkix_types.h	6
/src/botan/src/lib/asn1/ber_dec.cpp	19
/src/botan/build/include/botan/ber_dec.h	14
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/src/lib/asn1/asn1_obj.cpp	8
/src/botan/build/include/botan/internal/fmt.h	9
/src/botan/src/lib/utils/exceptn.cpp	8
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/exceptn.h	2
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/data_src.h	5
/src/botan/build/include/botan/internal/loadstor.h	3
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/build/include/botan/bigint.h	19
/src/botan/build/include/botan/mem_ops.h	5
/src/botan/src/lib/math/bigint/bigint.cpp	6
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/build/include/botan/internal/ct_utils.h	9
/src/botan/build/include/botan/assert.h	2
/src/botan/build/include/botan/internal/bit_ops.h	6
/src/botan/src/lib/asn1/asn1_oid.cpp	2
/src/botan/src/lib/utils/parsing.cpp	1
/src/botan/src/lib/x509/x509cert.cpp	1
/src/botan/build/include/botan/x509_obj.h	2
/src/botan/src/lib/x509/x509_obj.cpp	1
/src/botan/src/lib/pubkey/pem/pem.cpp	2
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/x509cert.h	1
/src/botan/build/include/botan/ocsp.h	4

Fuzzer: x509_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	331	31.3%
gold	[1:9]	264	25.0%
yellow	[10:29]	8	0.75%
greenyellow	[30:49]	22	2.08%
lawngreen	50+	431	40.8%
All colors	1056	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1794	3408	21 : View List ['Botan::BigInt::ct_cond_add(bool, Botan::BigInt const&)', 'Botan::operator>>(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt const&)', 'Botan::BigInt::set_sign(Botan::BigInt::Sign)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::bits() const', 'Botan::BigInt::operator+=(Botan::BigInt const&)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::BigInt::is_negative() const', 'Botan::BigInt::get_bit(unsigned long) const', 'Botan::BigInt::zero()', 'Botan::BigInt::is_nonzero() const', 'Botan::BigInt::operator*=(Botan::BigInt const&)', 'Botan::operator*(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator-(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::mask_bits(unsigned long)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::(anonymous namespace)::inverse_mod_pow2(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::BigInt::ct_cond_assign(bool, Botan::BigInt const&)']	2392	4648	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:189
629	631	10 : View List ['Botan::SHA1_F::(anonymous namespace)::F2(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'void Botan::load_be (unsigned int*, unsigned char const*, unsigned long)', 'Botan::SHA1_F::(anonymous namespace)::F4(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'unsigned int Botan::rotl<1ul, unsigned int>(unsigned int)', 'std::__1::vector >::operator[](unsigned long)', 'Botan::MDx_HashFunction::hash_block_size() const', 'Botan::SHA1_F::(anonymous namespace)::F1(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::data()', 'Botan::SHA1_F::(anonymous namespace)::F3(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::resize(unsigned long)']	629	631	Botan::SHA_1::compress_n(unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/hash/sha1/sha1.cpp:78
517	1787	69 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	517	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:161
331	376	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::decode(bool&)', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object&&)', 'Botan::BER_Decoder::verify_end()']	335	380	Botan::BER_Decoder&Botan::BER_Decoder::decode_optional (bool&,Botan::ASN1_Type,Botan::ASN1_Class,boolconst&)	call site: 00000	/src/botan/build/include/botan/ber_dec.h:317
299	314	3 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)']	299	314	Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const	call site: 00000	/src/botan/src/lib/math/numbertheory/reducer.cpp:79
299	307	2 : View List ['Botan::BigInt::~BigInt()', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']	299	576	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:194
290	6364	18 : View List ['Botan::operator<<(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::from_s32(int)', 'Botan::BigInt::operator=(Botan::BigInt const&)', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::operator-(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::operator>>=(unsigned long)', 'Botan::jacobi(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::operator-=(unsigned long)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::Modular_Reducer::multiply(Botan::BigInt const&, Botan::BigInt const&) const', 'Botan::BigInt::from_word(unsigned long)', 'Botan::Modular_Reducer::square(Botan::BigInt const&) const', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::operator!=(Botan::BigInt const&, unsigned long)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::operator>(Botan::BigInt const&, unsigned long)']	302	8561	Botan::sqrt_modulo_prime(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/numthry.cpp:57
211	211	1 : View List ['Botan::EC_Point::negate()']	227	246	Botan::EC_Point_Multi_Point_Precompute::multi_exp(Botan::BigIntconst&,Botan::BigIntconst&)const	call site: 00000	/src/botan/src/lib/pubkey/ec_group/point_mul.cpp:377
175	182	2 : View List ['Botan::BigInt::operator--()', 'Botan::BigInt::flip_sign()']	175	194	Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&)	call site: 00000	/src/botan/src/lib/math/bigint/divide.cpp:105
121	121	1 : View List ['void Botan::bigint_mod_sub_n<6ul>(unsigned long*, unsigned long const*, unsigned long const*, unsigned long*)']	121	135	Botan::BigInt::mod_sub(Botan::BigIntconst&,Botan::BigIntconst&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/math/bigint/big_ops2.cpp:110
103	103	1 : View List ['Botan::EC_Point::force_affine()']	103	103	Botan::EC_Point::force_all_affine(std::__1::vector >&,std::__1::vector >&)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_point.cpp:389
68	157	13 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::OID::OID(std::__1::vector >&&)', 'std::__1::vector >::empty() const', 'Botan::(anonymous namespace)::parse_oid_str(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt > >(std::__1::basic_string_view >, std::__1::basic_string_view > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::vector >&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::~vector()', '__cxa_allocate_exception', 'Botan::Lookup_Error::Lookup_Error(std::__1::basic_string_view >)']	76	165	Botan::OID::from_string(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/asn1/asn1_oid.cpp:78

Runtime coverage analysis

Covered functions

1237

Functions that are reachable but not covered

249

Reachable functions

828

Percentage of reachable functions covered

69.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/x509_path.cpp	1
/src/botan/build/include/botan/data_src.h	6
/src/botan/src/lib/x509/x509cert.cpp	37
/src/botan/build/include/botan/x509_obj.h	6
/src/botan/build/include/botan/asn1_obj.h	24
/src/botan/src/lib/x509/x509_obj.cpp	4
/src/botan/src/lib/asn1/asn1_obj.cpp	10
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/src/lib/utils/assert.cpp	2
/src/botan/src/lib/utils/exceptn.cpp	11
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	11
/src/botan/build/include/botan/exceptn.h	3
/src/botan/src/lib/pubkey/pem/pem.cpp	3
/src/botan/src/lib/asn1/ber_dec.cpp	10
/src/botan/build/include/botan/ber_dec.h	3
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/mem_ops.h	8
/src/botan/build/include/botan/internal/ct_utils.h	10
/src/botan/build/include/botan/internal/bit_ops.h	5
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/src/lib/x509/certstor.cpp	4
/src/botan/build/include/botan/certstor.h	4
/src/botan/src/lib/asn1/alg_id.cpp	2
/src/botan/src/lib/x509/x509path.cpp	15
/src/botan/build/include/botan/x509cert.h	2
/src/botan/src/lib/asn1/der_enc.cpp	3
/src/botan/build/include/botan/der_enc.h	3
/src/botan/build/include/botan/pk_keys.h	1
/src/botan/src/lib/pubkey/pk_keys.cpp	1
/src/botan/src/lib/hash/hash.cpp	2
/src/botan/src/lib/utils/scan_name.cpp	5
/src/botan/build/include/botan/internal/scan_name.h	4
/src/botan/src/lib/utils/parsing.cpp	4
/src/botan/build/include/botan/buf_comp.h	5
/src/botan/build/include/botan/hex.h	1
/src/botan/src/lib/codec/hex/hex.cpp	3
/usr/local/bin/../include/c++/v1/optional	7
/src/botan/build/include/botan/pkix_types.h	6
/src/botan/src/lib/x509/x509_dn.cpp	10
/src/botan/build/include/botan/internal/stl_util.h	3
/usr/include/ctype.h	3
/src/botan/build/include/botan/x509path.h	12
/src/botan/src/lib/asn1/asn1_time.cpp	6
/src/botan/src/lib/utils/calendar.cpp	4
/src/botan/build/include/botan/internal/calendar.h	7
/src/botan/src/lib/asn1/asn1_oid.cpp	7
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/x509/asn1_alt_name.cpp	2
/src/botan/build/include/botan/pkix_enums.h	3
/src/botan/src/lib/x509/x509_dn_ub.cpp	1
/src/botan/build/include/botan/x509_key.h	1
/src/botan/src/lib/pubkey/x509_key.cpp	1
/src/botan/build/include/botan/secmem.h	3
/src/botan/build/include/botan/internal/loadstor.h	4
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/src/lib/pubkey/pk_algs.cpp	1
/src/botan/src/lib/pubkey/pubkey.cpp	9
/src/botan/build/include/botan/pubkey.h	1
/src/botan/build/include/botan/bigint.h	20
/src/botan/src/lib/math/bigint/bigint.cpp	7
/src/botan/build/include/botan/internal/bswap.h	1
/src/botan/src/lib/math/bigint/big_code.cpp	1
/src/botan/build/include/botan/assert.h	2
/src/botan/src/lib/x509/x509_ext.cpp	1
/src/botan/src/lib/x509/x509_crl.cpp	9
/src/botan/src/lib/x509/crl_ent.cpp	3
/src/botan/build/include/botan/ocsp.h	7
/src/botan/src/lib/x509/ocsp.cpp	3
/src/botan/src/lib/x509/ocsp_types.cpp	1

Fuzzer: tls_client_hello

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	16.6%
gold	[1:9]	3	8.33%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	75.0%
All colors	36	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
859	1787	87 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	859	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:129
82	167	12 : View List ['__cxa_free_exception', 'Botan::TLS::Certificate_Status::~Certificate_Status()', '__cxa_throw', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (Botan::TLS::(anonymous namespace)::RFC6066_Empty_Certificate_Status_Request&&)', 'Botan::TLS::TLS_Exception::TLS_Exception(Botan::TLS::AlertType, std::__1::basic_string_view >)', 'std::__1::vector >::~vector()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (Botan::TLS::Certificate_Status&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::TLS::(anonymous namespace)::RFC6066_Empty_Certificate_Status_Request::RFC6066_Empty_Certificate_Status_Request(unsigned short)', 'Botan::TLS::Certificate_Status::Certificate_Status(std::__1::vector > const&, Botan::TLS::Connection_Side)', '__cxa_allocate_exception', 'std::__1::vector > Botan::TLS::TLS_Data_Reader::get_fixed (unsigned long)']	82	169	Botan::TLS::Certificate_Status_Request::Certificate_Status_Request(Botan::TLS::TLS_Data_Reader&,unsignedshort,Botan::TLS::Handshake_Type,Botan::TLS::Connection_Side)	call site: 00000	/src/botan/src/lib/tls/tls_extensions_cert_status_req.cpp:108
70	70	1 : View List ['Botan::TLS::TLS_Data_Reader::get_uint24_t()']	70	70	Botan::TLS::TLS_Data_Reader::get_length_field(unsignedlong)	call site: 00000	/src/botan/build/include/botan/internal/tls_reader.h:137
17	17	9 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::to_string(int)', 'std::__1::unique_ptr >::operator->() const', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', '__cxa_allocate_exception', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator >&&)']	17	17	Botan::TLS::Extensions::add(std::__1::unique_ptr >)	call site: 00000	/src/botan/src/lib/tls/tls_extensions.cpp:102
11	11	1 : View List ['Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']	17	19	Botan::MDx_HashFunction::MDx_HashFunction(unsignedlong,bool,bool,unsignedchar)	call site: 00000	/src/botan/src/lib/hash/mdx_hash/mdx_hash.cpp:30
6	19	7 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::vector >::~vector()', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Buffered_Computation::~Buffered_Computation()', '__cxa_allocate_exception']	6	19	Botan::MDx_HashFunction::MDx_HashFunction(unsignedlong,bool,bool,unsignedchar)	call site: 00000	/src/botan/src/lib/hash/mdx_hash/mdx_hash.cpp:33
4	4	3 : View List ['Botan::TLS::(anonymous namespace)::Server_PSK::~Server_PSK()', 'std::__1::optional ::optional(std::__1::nullopt_t)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (Botan::TLS::(anonymous namespace)::Server_PSK&&)']	10	93	Botan::TLS::PSK::PSK(Botan::TLS::TLS_Data_Reader&,unsignedshort,Botan::TLS::Handshake_Type)	call site: 00000	/src/botan/src/lib/tls/tls13/tls_extensions_psk.cpp:57
4	4	1 : View List ['Botan::SHA_256::compress_digest_x86(std::__1::vector >&, unsigned char const*, unsigned long)']	4	4	Botan::SHA_256::compress_digest(std::__1::vector >&,unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/hash/sha2_32/sha2_32.cpp:54
0	1536	8 : View List ['unsigned int Botan::majority (unsigned int, unsigned int, unsigned int)', 'unsigned int Botan::load_be (unsigned char const*, unsigned long)', 'unsigned int Botan::sigma<7ul, 18ul, 3ul, unsigned int>(unsigned int)', 'unsigned int Botan::sigma<17ul, 19ul, 10ul, unsigned int>(unsigned int)', 'unsigned int Botan::rho<2ul, 13ul, 22ul, unsigned int>(unsigned int)', 'std::__1::vector >::operator[](unsigned long)', 'unsigned int Botan::choose (unsigned int, unsigned int, unsigned int)', 'unsigned int Botan::rho<6ul, 11ul, 25ul, unsigned int>(unsigned int)']	0	1536	Botan::SHA_256::compress_digest(std::__1::vector >&,unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/hash/sha2_32/sha2_32.cpp:60
0	70	1 : View List ['Botan::TLS::TLS_Data_Reader::get_uint16_t()']	6	91	Botan::TLS::Supported_Versions::Supported_Versions(Botan::TLS::TLS_Data_Reader&,unsignedshort,Botan::TLS::Connection_Side)	call site: 00000	/src/botan/src/lib/tls/tls_extensions.cpp:616
0	70	2 : View List ['Botan::TLS::TLS_Data_Reader::get_uint32_t()', 'std::__1::optional ::optional (unsigned int&&)']	6	89	Botan::TLS::EarlyDataIndication::EarlyDataIndication(Botan::TLS::TLS_Data_Reader&,unsignedshort,Botan::TLS::Handshake_Type)	call site: 00000	/src/botan/src/lib/tls/tls_extensions.cpp:799
0	11	1 : View List ['Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)']	6	17	Botan::BER_Decoder::end_cons()	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:294

Runtime coverage analysis

Covered functions

331

Functions that are reachable but not covered

18

Reachable functions

61

Percentage of reachable functions covered

70.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/tls_client_hello.cpp	1
/src/botan/src/lib/tls/msg_client_hello.cpp	7
/src/botan/build/include/botan/tls_handshake_msg.h	2
/src/botan/src/lib/utils/assert.cpp	1
/src/botan/src/lib/utils/exceptn.cpp	3
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/fmt.h	3
/src/botan/build/include/botan/tls_extensions.h	5
/src/botan/build/include/botan/tls_exceptn.h	1

Fuzzer: tls_13_handshake_layer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	454	47.1%
gold	[1:9]	39	4.04%
yellow	[10:29]	42	4.36%
greenyellow	[30:49]	17	1.76%
lawngreen	50+	411	42.6%
All colors	963	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2682	2682	10 : View List ['std::__1::vector >::empty() const', 'std::__1::unique_ptr >::~unique_ptr()', '__cxa_end_catch', 'Botan::X509_Object::verify_signature(Botan::Public_Key const&) const', 'std::__1::unique_ptr >::operator*() const', 'bool std::__1::operator== >(std::__1::vector > const&, std::__1::vector > const&)', '__cxa_begin_catch', 'std::__1::vector >::vector(std::__1::vector > const&)', 'Botan::X509::load_key(std::__1::vector >)', 'std::__1::pair , std::__1::allocator > >::~pair()']	3375	3874	Botan::(anonymousnamespace)::parse_x509_cert_body(Botan::X509_Objectconst&)	call site: 00000	/src/botan/src/lib/x509/x509cert.cpp:218
859	1787	87 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	859	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:129
230	230	2 : View List ['Botan::TLS::Hello_Retry_Request::Hello_Retry_Request(std::__1::unique_ptr >)', 'std::__1::variant ::variant (Botan::TLS::Hello_Retry_Request&&)']	230	232	Botan::TLS::Server_Hello_13::parse(std::__1::vector >const&)	call site: 00000	/src/botan/src/lib/tls/msg_server_hello.cpp:482
87	87	2 : View List ['std::__1::__unique_if ::__unique_single std::__1::make_unique (Botan::TLS::(anonymous namespace)::Key_Share_HelloRetryRequest&&)', 'Botan::TLS::(anonymous namespace)::Key_Share_HelloRetryRequest::Key_Share_HelloRetryRequest(Botan::TLS::TLS_Data_Reader&, unsigned short)']	87	89	Botan::TLS::Key_Share::Key_Share(Botan::TLS::TLS_Data_Reader&,unsignedshort,Botan::TLS::Handshake_Type)	call site: 00000	/src/botan/src/lib/tls/tls13/tls_extensions_key_share.cpp:394
50	124	6 : View List ['Botan::TLS::Certificate_Status::~Certificate_Status()', 'std::__1::vector >::~vector()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (Botan::TLS::Certificate_Status&&)', 'std::__1::unique_ptr >::operator=(std::__1::unique_ptr >&&)', 'Botan::TLS::Certificate_Status::Certificate_Status(std::__1::vector > const&, Botan::TLS::Connection_Side)', 'std::__1::vector > Botan::TLS::TLS_Data_Reader::get_fixed (unsigned long)']	50	126	Botan::TLS::Certificate_Status_Request::Certificate_Status_Request(Botan::TLS::TLS_Data_Reader&,unsignedshort,Botan::TLS::Handshake_Type,Botan::TLS::Connection_Side)	call site: 00000	/src/botan/src/lib/tls/tls_extensions_cert_status_req.cpp:138
21	57	4 : View List ['Botan::BER_Decoder::~BER_Decoder()', 'Botan::BER_Decoder::decode(Botan::ASN1_Object&, Botan::ASN1_Type, Botan::ASN1_Class)', 'Botan::BER_Decoder::BER_Decoder(Botan::BER_Object const&)', 'Botan::BER_Decoder::verify_end()']	5502	6048	Botan::(anonymousnamespace)::parse_x509_cert_body(Botan::X509_Objectconst&)	call site: 00000	/src/botan/src/lib/x509/x509cert.cpp:145
6	89	10 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::TLS::TLS_Exception::TLS_Exception(Botan::TLS::AlertType, std::__1::basic_string_view >)', 'Botan::TLS::Protocol_Version::to_string() const', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', '__cxa_allocate_exception', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator >&&)']	6	89	Botan::TLS::Protocol_Version::operator>(Botan::TLS::Protocol_Versionconst&)const	call site: 00000	/src/botan/src/lib/tls/tls_version.cpp:49
6	19	7 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::vector >::~vector()', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Buffered_Computation::~Buffered_Computation()', '__cxa_allocate_exception']	6	19	Botan::MDx_HashFunction::MDx_HashFunction(unsignedlong,bool,bool,unsignedchar)	call site: 00000	/src/botan/src/lib/hash/mdx_hash/mdx_hash.cpp:33
6	17	5 : View List ['__cxa_free_exception', '__cxa_throw', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_allocate_exception']	6	17	Botan::BER_Decoder::push_back(Botan::BER_Object&&)	call site: 00000	/src/botan/src/lib/asn1/ber_dec.cpp:278
6	17	9 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::to_string(int)', 'std::__1::unique_ptr >::operator->() const', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', '__cxa_allocate_exception', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator >&&)']	6	17	Botan::TLS::Extensions::add(std::__1::unique_ptr >)	call site: 00000	/src/botan/src/lib/tls/tls_extensions.cpp:102
6	17	7 : View List ['__cxa_free_exception', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', '__cxa_throw', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, char const*)', '__cxa_allocate_exception', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator > const&)']	6	17	Botan::to_u32bit(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/utils/parsing.cpp:46
4	4	1 : View List ['Botan::SHA_256::compress_digest_x86(std::__1::vector >&, unsigned char const*, unsigned long)']	4	4	Botan::SHA_256::compress_digest(std::__1::vector >&,unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/hash/sha2_32/sha2_32.cpp:54

Runtime coverage analysis

Covered functions

564

Functions that are reachable but not covered

187

Reachable functions

655

Percentage of reachable functions covered

71.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	1
/src/botan/./src/fuzzer/tls_13_handshake_layer.cpp	2
/src/botan/build/include/botan/internal/tls_handshake_layer_13.h	2
/src/botan/src/lib/tls/tls13/tls_handshake_layer_13.cpp	6
/src/botan/src/lib/tls/tls13/tls_transcript_hash_13.cpp	5
/src/botan/src/lib/utils/assert.cpp	3
/src/botan/build/include/botan/internal/fmt.h	11
/src/botan/build/include/botan/exceptn.h	2
/src/botan/src/lib/utils/exceptn.cpp	10
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/src/lib/hash/hash.cpp	2
/src/botan/src/lib/utils/scan_name.cpp	5
/src/botan/build/include/botan/internal/scan_name.h	4
/src/botan/src/lib/utils/parsing.cpp	2
/src/botan/build/include/botan/internal/tls_reader.h	16
/src/botan/build/include/botan/internal/loadstor.h	4
/src/botan/build/include/botan/tls_exceptn.h	1
/src/botan/build/include/botan/buf_comp.h	3
/src/botan/src/lib/tls/msg_client_hello.cpp	13
/src/botan/build/include/botan/tls_extensions.h	21
/src/botan/build/include/botan/tls_version.h	5
/src/botan/src/lib/tls/tls_extensions.cpp	6
/src/botan/src/lib/tls/tls_version.cpp	4
/src/botan/build/include/botan/tls_handshake_msg.h	2
/src/botan/src/lib/tls/tls13/tls_extensions_key_share.cpp	1
/src/botan/build/include/botan/internal/stl_util.h	4
/src/botan/src/lib/tls/msg_server_hello.cpp	18
/src/botan/src/lib/tls/tls13/msg_encrypted_extensions.cpp	1
/src/botan/build/include/botan/tls_messages.h	10
/src/botan/src/lib/tls/tls13/msg_certificate_13.cpp	1
/src/botan/build/include/botan/x509cert.h	2
/src/botan/build/include/botan/x509_obj.h	3
/src/botan/build/include/botan/asn1_obj.h	16
/src/botan/src/lib/x509/x509cert.cpp	5
/src/botan/build/include/botan/data_src.h	6
/src/botan/src/lib/x509/x509_obj.cpp	1
/src/botan/src/lib/asn1/asn1_obj.cpp	7
/src/botan/src/lib/utils/data_src.cpp	3
/src/botan/src/lib/pubkey/pem/pem.cpp	3
/src/botan/src/lib/asn1/ber_dec.cpp	7
/src/botan/build/include/botan/ber_dec.h	2
/src/botan/src/lib/codec/base64/base64.cpp	6
/src/botan/build/include/botan/internal/codec_base.h	3
/src/botan/build/include/botan/internal/rounding.h	1
/src/botan/build/include/botan/mem_ops.h	2
/src/botan/build/include/botan/internal/ct_utils.h	7
/src/botan/build/include/botan/internal/bit_ops.h	3
/src/botan/src/lib/utils/charset.cpp	1
/src/botan/build/include/botan/x509_key.h	1
/src/botan/src/lib/pubkey/x509_key.cpp	1
/src/botan/build/include/botan/secmem.h	1
/src/botan/build/include/botan/internal/safeint.h	2
/src/botan/src/lib/pubkey/pk_algs.cpp	1
/src/botan/src/lib/asn1/asn1_oid.cpp	4
/src/botan/src/lib/asn1/oid_map.cpp	2
/src/botan/src/lib/asn1/oid_maps.cpp	2
/src/botan/build/include/botan/internal/oid_map.h	1
/src/botan/src/lib/tls/tls_policy.cpp	1
/src/botan/src/lib/tls/tls13/msg_certificate_req_13.cpp	1
/src/botan/src/lib/tls/msg_cert_verify.cpp	2
/src/botan/src/lib/tls/tls_signature_scheme.cpp	8
/src/botan/build/include/botan/tls_signature_scheme.h	1
/src/botan/src/lib/tls/msg_finished.cpp	1
/src/botan/build/include/botan/assert.h	2
/src/botan/src/lib/tls/msg_session_ticket.cpp	1
/src/botan/build/include/botan/strong_type.h	7
/src/botan/src/lib/tls/tls13/msg_key_update.cpp	1
/src/botan/build/include/botan/internal/tls_transcript_hash_13.h	1

Fuzzer: tls_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	19	41.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	6	13.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	21	45.6%
All colors	46	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3463	3483	45 : View List ['Botan::TLS::Certificate_12::empty() const', 'std::__1::vector >::~vector()', 'std::__1::vector , std::__1::allocator > >::~vector()', 'Botan::TLS::Server_Hello_12::supports_session_ticket() const', '__cxa_end_catch', 'Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(Botan::TLS::Handshake_IO&, Botan::TLS::Handshake_State&, Botan::TLS::Policy const&, Botan::Credentials_Manager&, Botan::Public_Key const*, std::__1::basic_string_view >, Botan::RandomNumberGenerator&)', 'std::__1::unique_ptr >::get() const', 'Botan::TLS::Handshake_State::server_hello_done(Botan::TLS::Server_Hello_Done*)', 'std::__1::shared_ptr ::operator->() const', 'std::__1::shared_ptr ::~shared_ptr()', 'std::__1::vector >::~vector()', '__clang_call_terminate', 'Botan::TLS::Handshake_State::client_certs() const', 'Botan::TLS::Certificate_12::Certificate_12(Botan::TLS::Handshake_IO&, Botan::TLS::Handshake_Hash&, std::__1::vector > const&)', '__cxa_begin_catch', 'Botan::TLS::Server_Hello_12::supports_certificate_status_message() const', 'std::__1::__optional_destruct_base ::~__optional_destruct_base()', 'Botan::TLS::Certificate_Request_12::acceptable_cert_types() const', 'Botan::TLS::Channel_Impl_12::policy() const', 'Botan::TLS::Certificate_12::cert_chain() const', 'std::__1::vector >::operator[](unsigned long) const', 'Botan::TLS::Handshake_State::cert_req() const', 'Botan::TLS::Handshake_State::client_verify(Botan::TLS::Certificate_Verify_12*)', 'Botan::TLS::Handshake_State::client_kex(Botan::TLS::Client_Key_Exchange*)', 'std::__1::shared_ptr ::operator*() const', 'std::__1::vector , std::__1::allocator > >::vector()', 'std::__1::shared_ptr ::operator bool() const', 'Botan::TLS::Handshake_State::server_certs() const', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::shared_ptr ::get() const', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::basic_string , std::__1::allocator >::basic_string (char const*)', 'Botan::TLS::Handshake_State::server_cert_status() const', 'Botan::TLS::Certificate_Status::response() const', 'Botan::TLS::Server_Information::hostname() const', 'Botan::TLS::Handshake_State::client_certs(Botan::TLS::Certificate_12*)', 'std::__1::vector >::vector()', '__cxa_rethrow', 'Botan::TLS::Handshake_State::received_handshake_msg(Botan::TLS::Handshake_Type) const', 'Botan::TLS::Channel_Impl_12::rng()', 'Botan::TLS::Certificate_Request_12::acceptable_CAs() const', 'Botan::TLS::Certificate_Verify_12::Certificate_Verify_12(Botan::TLS::Handshake_IO&, Botan::TLS::Handshake_State&, Botan::TLS::Policy const&, Botan::RandomNumberGenerator&, Botan::Private_Key const*)', 'std::__1::optional & std::__1::vector , std::__1::allocator > >::emplace_back >(std::__1::optional &&)', 'Botan::TLS::Handshake_State::compute_session_keys()', 'Botan::TLS::Server_Hello_Done::Server_Hello_Done(std::__1::vector > const&)']	4751	4938	Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Handshake_State&,Botan::TLS::Handshake_Type,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:520
2850	2926	49 : View List ['Botan::TLS::Server_Hello::ciphersuite() const', 'Botan::TLS::Session_Handle::Session_Handle(Botan::Strong >, Botan::TLS::Session_Ticket_>)', 'Botan::TLS::Handshake_State::session_keys() const', 'Botan::TLS::Finished_12::Finished(std::__1::vector > const&)', 'Botan::TLS::Handshake_Hash::update(std::__1::vector > const&)', 'Botan::TLS::Server_Hello_12::srtp_profile() const', 'Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_State const*, Botan::TLS::Handshake_State&, Botan::TLS::Handshake_Type, std::__1::vector > const&, bool)::$_0::operator()() const', 'Botan::TLS::Session_Keys::master_secret() const', 'operator delete(void*)', 'Botan::TLS::Channel_Impl_12::callbacks() const', 'Botan::TLS::New_Session_Ticket_12::ticket_lifetime_hint() const', 'Botan::TLS::Channel_Impl_12::activate_session()', 'Botan::TLS::Handshake_Message::~Handshake_Message()', 'Botan::TLS::Server_Hello_12::supports_encrypt_then_mac() const', 'Botan::TLS::Handshake_State::hash()', 'Botan::TLS::Server_Hello_12::supports_extended_master_secret() const', 'Botan::TLS::(anonymous namespace)::Client_Handshake_State_12::is_a_resumption() const', 'Botan::detail::Strong_Base > >::~Strong_Base()', 'operator new(unsigned long)', 'std::__1::__optional_destruct_base ::~__optional_destruct_base()', 'std::__1::__optional_storage_base ::has_value() const', 'Botan::detail::Strong_Adapter > >::empty() const', 'Botan::TLS::Client_Hello_12::session_ticket() const', 'std::__1::vector >::~vector()', 'Botan::TLS::Handshake_State::server_hello() const', 'Botan::TLS::Session_Handle::is_ticket() const', 'Botan::TLS::Handshake_State::client_finished(Botan::TLS::Finished_12*)', 'Botan::TLS::Channel_Impl_12::session_manager()', 'Botan::TLS::Session_Handle::~Session_Handle()', 'std::__1::optional ::value() const &', 'std::__1::optional ::operator->() const', 'Botan::TLS::TLS_Exception::TLS_Exception(Botan::TLS::AlertType, std::__1::basic_string_view >)', 'std::__1::chrono::duration >::max()', 'std::__1::vector >::~vector()', 'Botan::TLS::Handshake_State::client_finished() const', 'Botan::TLS::Channel_Impl_12::change_cipher_spec_writer(Botan::TLS::Connection_Side)', 'Botan::TLS::Session::~Session()', 'Botan::TLS::Handshake_State::new_session_ticket() const', 'Botan::TLS::Change_Cipher_Spec::Change_Cipher_Spec()', 'Botan::TLS::Session::Session(std::__1::vector > const&, Botan::TLS::Protocol_Version, unsigned short, Botan::TLS::Connection_Side, bool, bool, std::__1::vector > const&, Botan::TLS::Server_Information const&, unsigned short, std::__1::chrono::time_point > >, std::__1::chrono::duration >)', 'Botan::TLS::Handshake_State::server_finished() const', 'Botan::TLS::Handshake_State::server_finished(Botan::TLS::Finished_12*)', 'Botan::TLS::Session_Summary::~Session_Summary()', 'Botan::TLS::Handshake_State::client_hello() const', 'Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_State const*, Botan::TLS::Handshake_State&, Botan::TLS::Handshake_Type, std::__1::vector > const&, bool)::$_1::operator()() const', 'Botan::TLS::Finished_12::verify(Botan::TLS::Handshake_State const&, Botan::TLS::Connection_Side) const', 'Botan::TLS::Handshake_State::handshake_io()', 'Botan::TLS::Finished_12::Finished_12(Botan::TLS::Handshake_IO&, Botan::TLS::Handshake_State&, Botan::TLS::Connection_Side)', 'Botan::TLS::Server_Hello::legacy_version() const']	2862	2938	Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Handshake_State&,Botan::TLS::Handshake_Type,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:591
2597	2597	16 : View List ['std::__1::unique_ptr >::operator->() const', 'Botan::X509_Certificate::constraints() const', 'std::__1::vector >::empty() const', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::X509_Certificate::subject_public_key() const', 'Botan::X509_Certificate::~X509_Certificate()', 'std::__1::vector >::at(unsigned long) const', 'std::__1::unique_ptr >::release()', 'Botan::X509_Certificate::X509_Certificate(Botan::X509_Certificate const&)', 'Botan::TLS::Ciphersuite::sig_algo() const', 'bool std::__1::operator== >(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)', 'Botan::operator!=(Botan::X509_Certificate const&, Botan::X509_Certificate const&)', 'std::__1::unique_ptr >::reset(Botan::Public_Key*)', 'Botan::TLS::(anonymous namespace)::key_usage_matches_ciphersuite(Botan::Key_Constraints, Botan::TLS::Ciphersuite const&)', 'Botan::TLS::Handshake_State::server_certs(Botan::TLS::Certificate_12*)', 'Botan::TLS::Certificate_12::Certificate_12(std::__1::vector > const&, Botan::TLS::Policy const&)']	2778	3009	Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Handshake_State&,Botan::TLS::Handshake_Type,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:436
1157	1167	9 : View List ['Botan::TLS::Session_Base::ciphersuite() const', 'Botan::TLS::Protocol_Version::operator==(Botan::TLS::Protocol_Version const&) const', 'std::__1::remove_reference ::type&& std::__1::move (Botan::TLS::Session&)', 'Botan::TLS::Client_Hello_12::Client_Hello_12(Botan::TLS::Handshake_IO&, Botan::TLS::Handshake_Hash&, Botan::TLS::Policy const&, Botan::TLS::Callbacks&, Botan::RandomNumberGenerator&, std::__1::vector > const&, Botan::TLS::Session_with_Handle const&, std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)', 'Botan::TLS::Protocol_Version::is_datagram_protocol() const', 'std::__1::optional ::operator->()', 'std::__1::optional ::value() &', 'Botan::TLS::Session_Base::version() const', 'std::__1::optional & std::__1::optional ::operator= (Botan::TLS::Session&&)']	1161	1945	Botan::TLS::Client_Impl_12::send_client_hello(Botan::TLS::Handshake_State&,bool,Botan::TLS::Protocol_Version,std::__1::optional ,std::__1::vector ,std::__1::allocator >,std::__1::allocator ,std::__1::allocator >>>const&)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:157
752	806	2 : View List ['Botan::TLS::Handshake_State::set_expected_next(Botan::TLS::Handshake_Type)', 'Botan::TLS::Channel_Impl_12::change_cipher_spec_reader(Botan::TLS::Connection_Side)']	752	806	Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Handshake_State&,Botan::TLS::Handshake_Type,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:587
674	736	7 : View List ['Botan::TLS::Handshake_State::compute_session_keys(std::__1::vector > const&)', 'Botan::TLS::Server_Hello_12::supports_session_ticket() const', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'std::__1::optional ::operator->()', 'std::__1::__optional_storage_base ::has_value() const', 'Botan::TLS::(anonymous namespace)::Client_Handshake_State_12::resume_master_secret() const', 'Botan::TLS::Session_Base::supports_extended_master_secret() const']	720	883	Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Handshake_State&,Botan::TLS::Handshake_Type,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:351
666	672	11 : View List ['Botan::TLS::Handshake_State::ciphersuite() const', 'Botan::TLS::Ciphersuite::psk_ciphersuite() const', 'Botan::TLS::Ciphersuite::signature_used() const', 'Botan::TLS::Ciphersuite::auth_method() const', 'Botan::TLS::(anonymous namespace)::Client_Handshake_State_12::get_server_public_key() const', 'Botan::TLS::Server_Key_Exchange::Server_Key_Exchange(std::__1::vector > const&, Botan::TLS::Kex_Algo, Botan::TLS::Auth_Method, Botan::TLS::Protocol_Version)', 'Botan::TLS::Handshake_State::version() const', 'Botan::TLS::Handshake_State::server_kex() const', 'Botan::TLS::Server_Key_Exchange::verify(Botan::Public_Key const&, Botan::TLS::Handshake_State const&, Botan::TLS::Policy const&) const', 'Botan::TLS::Handshake_State::server_kex(Botan::TLS::Server_Key_Exchange*)', 'Botan::TLS::Ciphersuite::kex_method() const']	672	799	Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Handshake_State&,Botan::TLS::Handshake_Type,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:502
273	1787	84 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::~vector()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	273	1787	Botan::HashFunction::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/hash/hash.cpp:135
201	201	1 : View List ['Botan::TLS::(anonymous namespace)::read_dtls_record(std::__1::vector >&, unsigned char const*, unsigned long, unsigned long&, std::__1::vector >&, Botan::TLS::Connection_Sequence_Numbers*, std::__1::function (unsigned short)> const&, bool)']	201	201	Botan::TLS::read_record(bool,std::__1::vector >&,unsignedcharconst*,unsignedlong,unsignedlong&,std::__1::vector >&,Botan::TLS::Connection_Sequence_Numbers*,std::__1::function (unsignedshort)>const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_record.cpp:500
186	186	2 : View List ['Botan::TLS::Certificate_Request_12::Certificate_Request_12(std::__1::vector > const&)', 'Botan::TLS::Handshake_State::cert_req(Botan::TLS::Certificate_Request_12*)']	186	240	Botan::TLS::Client_Impl_12::process_handshake_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Handshake_State&,Botan::TLS::Handshake_Type,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_client_impl_12.cpp:517
177	177	3 : View List ['Botan::TLS::(anonymous namespace)::Key_Share_ClientHello::Key_Share_ClientHello(Botan::TLS::TLS_Data_Reader&, unsigned short)', 'Botan::TLS::(anonymous namespace)::Key_Share_ClientHello::~Key_Share_ClientHello()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (Botan::TLS::(anonymous namespace)::Key_Share_ClientHello&&)']	177	179	Botan::TLS::Key_Share::Key_Share(Botan::TLS::TLS_Data_Reader&,unsignedshort,Botan::TLS::Handshake_Type)	call site: 00000	/src/botan/src/lib/tls/tls13/tls_extensions_key_share.cpp:392
166	228	7 : View List ['std::__1::function (unsigned short)>::operator()(unsigned short) const', 'std::__1::shared_ptr ::~shared_ptr()', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::TLS::(anonymous namespace)::decrypt_record(std::__1::vector >&, unsigned char*, unsigned long, unsigned long, Botan::TLS::Protocol_Version, Botan::TLS::Record_Type, Botan::TLS::Connection_Cipher_State&)', 'std::__1::shared_ptr ::operator*() const', 'std::__1::shared_ptr ::operator bool() const', 'std::__1::vector >::operator[](unsigned long)']	166	230	Botan::TLS::(anonymousnamespace)::read_tls_record(std::__1::vector >&,unsignedcharconst*,unsignedlong,unsignedlong&,std::__1::vector >&,Botan::TLS::Connection_Sequence_Numbers*,std::__1::function (unsignedshort)>const&)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_record.cpp:384

Runtime coverage analysis

Covered functions

678

Functions that are reachable but not covered

43

Reachable functions

85

Percentage of reachable functions covered

49.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	2
/src/botan/./src/fuzzer/tls_client.cpp	1
/src/botan/build/include/botan/tls_version.h	3
/src/botan/build/include/botan/tls_server_info.h	3
/src/botan/src/lib/tls/tls_client.cpp	3
/src/botan/build/include/botan/tls_channel.h	3
/src/botan/src/lib/utils/assert.cpp	3
/src/botan/build/include/botan/internal/fmt.h	4
/src/botan/src/lib/utils/exceptn.cpp	4
/usr/local/bin/../include/c++/v1/exception	1
/src/botan/build/include/botan/internal/tls_channel_impl.h	4
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/tls/tls_version.cpp	1

Fuzzer: tls_server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	12.9%
gold	[1:9]	5	16.1%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	22	70.9%
All colors	31	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2708	3868	12 : View List ['std::__1::span ::span >&>(std::__1::vector >&)', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'Botan::AlgorithmIdentifier::parameters() const', 'std::__1::basic_string , std::__1::allocator > Botan::fmt (std::__1::basic_string_view >, Botan::OID const&)', 'Botan::pbes2_decrypt(std::__1::span , std::__1::basic_string_view >, std::__1::vector > const&)', 'Botan::OID::to_formatted_string() const', 'std::__1::function , std::__1::allocator > ()>::operator()() const', 'Botan::PKCS8_Exception::PKCS8_Exception(std::__1::basic_string_view >)', 'Botan::AlgorithmIdentifier::oid() const', 'bool std::__1::operator!= , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::vector >::operator=(std::__1::vector >&&)']	2784	5077	Botan::PKCS8::(anonymousnamespace)::PKCS8_decode(Botan::DataSource&,std::__1::function ,std::__1::allocator >()>const&,Botan::AlgorithmIdentifier&,bool)	call site: 00000	/src/botan/src/lib/pubkey/pkcs8.cpp:85
2690	2690	9 : View List ['Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::vector >::size() const', 'std::__1::vector >::data()', 'std::__1::basic_string_view >::size() const', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr &&)', 'std::__1::vector >::~vector()']	2696	2721	Botan::EC_Group::EC_Group(std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/pubkey/ec_group/ec_group.cpp:407
1732	1732	7 : View List ['std::__1::optional ::value() &', 'Botan::TLS::Session_with_Handle::~Session_with_Handle()', 'Botan::TLS::Session::~Session()', 'Botan::TLS::Session::Session(Botan::TLS::Session const&)', 'Botan::TLS::Session_Handle::Session_Handle(Botan::TLS::Session_Handle const&)', 'std::__1::optional ::value() const &', 'Botan::TLS::Server_Impl_12::session_resume(Botan::TLS::Server_Handshake_State&, Botan::TLS::Session_with_Handle const&)']	1732	1732	Botan::TLS::Server_Impl_12::process_client_hello_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Server_Handshake_State&,std::__1::vector >const&,bool)	call site: 00000	/src/botan/src/lib/tls/tls12/tls_server_impl_12.cpp:438
1670	3408	21 : View List ['Botan::BigInt::ct_cond_add(bool, Botan::BigInt const&)', 'Botan::operator>>(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt const&)', 'Botan::BigInt::set_sign(Botan::BigInt::Sign)', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::bits() const', 'Botan::BigInt::operator+=(Botan::BigInt const&)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::BigInt::is_negative() const', 'Botan::BigInt::get_bit(unsigned long) const', 'Botan::BigInt::zero()', 'Botan::BigInt::is_nonzero() const', 'Botan::BigInt::operator*=(Botan::BigInt const&)', 'Botan::operator*(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator-(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::mask_bits(unsigned long)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::(anonymous namespace)::inverse_mod_pow2(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::BigInt::ct_cond_assign(bool, Botan::BigInt const&)']	2268	4648	Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&)	call site: 00000	/src/botan/src/lib/math/numbertheory/mod_inv.cpp:189
1208	2337	36 : View List ['std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr > Botan::(anonymous namespace)::kdf_create_mac_or_hash (std::__1::basic_string_view >)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::unique_ptr >::~unique_ptr()', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'Botan::MessageAuthenticationCode::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt , std::__1::allocator > >(std::__1::basic_string_view >, std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr > Botan::(anonymous namespace)::kdf_create_mac_or_hash (std::__1::basic_string_view >)', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'std::__1::basic_string_view >::empty() const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::unique_ptr > Botan::(anonymous namespace)::kdf_create_mac_or_hash (std::__1::basic_string_view >)', 'std::__1::unique_ptr >::operator bool() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::operator bool() const']	1212	2737	Botan::KDF::create(std::__1::basic_string_view >,std::__1::basic_string_view >)	call site: 00000	/src/botan/src/lib/kdf/kdf.cpp:126
613	631	10 : View List ['Botan::SHA1_F::(anonymous namespace)::F2(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'void Botan::load_be (unsigned int*, unsigned char const*, unsigned long)', 'Botan::SHA1_F::(anonymous namespace)::F4(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'unsigned int Botan::rotl<1ul, unsigned int>(unsigned int)', 'std::__1::vector >::operator[](unsigned long)', 'Botan::MDx_HashFunction::hash_block_size() const', 'Botan::SHA1_F::(anonymous namespace)::F1(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::data()', 'Botan::SHA1_F::(anonymous namespace)::F3(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::vector >::resize(unsigned long)']	613	631	Botan::SHA_1::compress_n(unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/hash/sha1/sha1.cpp:78
447	606	5 : View List ['Botan::AES_128::vperm_key_schedule(unsigned char const*, unsigned long)', 'Botan::CPUID::has_hw_aes()', 'Botan::(anonymous namespace)::aes_key_schedule(unsigned char const*, unsigned long, std::__1::vector >&, std::__1::vector >&, bool)', 'Botan::CPUID::has_vperm()', 'Botan::CPUID::is_little_endian()']	447	606	Botan::AES_128::key_schedule(unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/block/aes/aes.cpp:832
447	606	5 : View List ['Botan::CPUID::has_hw_aes()', 'Botan::AES_256::vperm_key_schedule(unsigned char const*, unsigned long)', 'Botan::(anonymous namespace)::aes_key_schedule(unsigned char const*, unsigned long, std::__1::vector >&, std::__1::vector >&, bool)', 'Botan::CPUID::has_vperm()', 'Botan::CPUID::is_little_endian()']	447	606	Botan::AES_256::key_schedule(unsignedcharconst*,unsignedlong)	call site: 00000	/src/botan/src/lib/block/aes/aes.cpp:958
342	342	3 : View List ['Botan::(anonymous namespace)::aes_decrypt_n(unsigned char const*, unsigned char*, unsigned long, std::__1::vector > const&)', 'Botan::AES_128::vperm_decrypt_n(unsigned char const*, unsigned char*, unsigned long) const', 'Botan::CPUID::has_vperm()']	342	342	Botan::AES_128::decrypt_n(unsignedcharconst*,unsignedchar*,unsignedlong)const	call site: 00000	/src/botan/src/lib/block/aes/aes.cpp:816
342	342	3 : View List ['Botan::AES_256::vperm_decrypt_n(unsigned char const*, unsigned char*, unsigned long) const', 'Botan::(anonymous namespace)::aes_decrypt_n(unsigned char const*, unsigned char*, unsigned long, std::__1::vector > const&)', 'Botan::CPUID::has_vperm()']	342	342	Botan::AES_256::decrypt_n(unsignedcharconst*,unsignedchar*,unsignedlong)const	call site: 00000	/src/botan/src/lib/block/aes/aes.cpp:942
337	337	3 : View List ['Botan::CPUID::has_vperm()', 'Botan::(anonymous namespace)::aes_encrypt_n(unsigned char const*, unsigned char*, unsigned long, std::__1::vector > const&)', 'Botan::AES_128::vperm_encrypt_n(unsigned char const*, unsigned char*, unsigned long) const']	337	337	Botan::AES_128::encrypt_n(unsignedcharconst*,unsignedchar*,unsignedlong)const	call site: 00000	/src/botan/src/lib/block/aes/aes.cpp:798
337	337	3 : View List ['Botan::CPUID::has_vperm()', 'Botan::(anonymous namespace)::aes_encrypt_n(unsigned char const*, unsigned char*, unsigned long, std::__1::vector > const&)', 'Botan::AES_256::vperm_encrypt_n(unsigned char const*, unsigned char*, unsigned long) const']	337	337	Botan::AES_256::encrypt_n(unsignedcharconst*,unsignedchar*,unsignedlong)const	call site: 00000	/src/botan/src/lib/block/aes/aes.cpp:924

Runtime coverage analysis

Covered functions

2157

Functions that are reachable but not covered

21

Reachable functions

63

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/botan/./src/fuzzer/fuzzers.h	2
/src/botan/./src/fuzzer/tls_server.cpp	1
/src/botan/build/include/botan/tls_server_info.h	2
/src/botan/src/lib/tls/tls_server.cpp	2
/src/botan/build/include/botan/tls_channel.h	3
/src/botan/src/lib/tls/tls_version.cpp	2
/src/botan/build/include/botan/tls_version.h	3
/src/botan/build/include/botan/internal/tls_channel_impl.h	2
/src/botan/src/lib/utils/assert.cpp	1
/src/botan/build/include/botan/internal/fmt.h	3
/src/botan/build/include/botan/exceptn.h	1
/src/botan/src/lib/utils/exceptn.cpp	1
/usr/local/bin/../include/c++/v1/exception	1