Fuzz introspector: tls_server
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2880 4160 12 :

['Botan::PKCS8_Exception::PKCS8_Exception(std::__1::basic_string_view >)', 'std::__1::vector >::operator=(std::__1::vector >&&)', 'std::__1::function , std::__1::allocator > ()>::operator()() const', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::span ::span >&>(std::__1::vector >&)', 'bool std::__1::operator!= , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt (std::__1::basic_string_view >, Botan::OID const&)', 'Botan::pbes2_decrypt(std::__1::span , std::__1::basic_string_view >, std::__1::vector > const&)', 'Botan::AlgorithmIdentifier::parameters() const', 'Botan::OID::to_formatted_string() const', 'Botan::AlgorithmIdentifier::oid() const', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const']

2956 5388 Botan::PKCS8::(anonymousnamespace)::PKCS8_decode(Botan::DataSource&,std::__1::function ,std::__1::allocator >()>const&,Botan::AlgorithmIdentifier&,bool) call site: 00000 /src/botan/src/lib/pubkey/pkcs8.cpp:85
2729 2729 10 :

['std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::basic_string_view >::size() const', 'Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::vector >::data()', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr const&)', 'std::__1::vector >::~vector()', 'std::__1::pair , bool>::~pair()', 'std::__1::vector >::size() const']

2735 2760 Botan::EC_Group::EC_Group(std::__1::basic_string_view >) call site: 00000 /src/botan/src/lib/pubkey/ec_group/ec_group.cpp:421
1762 1762 7 :

['Botan::TLS::Session::Session(Botan::TLS::Session const&)', 'Botan::TLS::Session::~Session()', 'std::__1::optional ::value() &', 'Botan::TLS::Session_with_Handle::~Session_with_Handle()', 'std::__1::optional ::value() const &', 'Botan::TLS::Server_Impl_12::session_resume(Botan::TLS::Server_Handshake_State&, Botan::TLS::Session_with_Handle const&)', 'Botan::TLS::Session_Handle::Session_Handle(Botan::TLS::Session_Handle const&)']

1762 1762 Botan::TLS::Server_Impl_12::process_client_hello_msg(Botan::TLS::Handshake_Stateconst*,Botan::TLS::Server_Handshake_State&,std::__1::vector >const&,bool) call site: 00000 /src/botan/src/lib/tls/tls12/tls_server_impl_12.cpp:457
1672 3412 21 :

['Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::BigInt::BigInt(Botan::BigInt const&)', 'Botan::BigInt::ct_cond_add(bool, Botan::BigInt const&)', 'Botan::operator*(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::operator+=(Botan::BigInt const&)', 'Botan::BigInt::ct_cond_assign(bool, Botan::BigInt const&)', 'Botan::BigInt::is_nonzero() const', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::operator-(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::operator>>(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::is_negative() const', 'Botan::BigInt::mask_bits(unsigned long)', 'Botan::BigInt::zero()', 'Botan::BigInt::set_sign(Botan::BigInt::Sign)', 'Botan::BigInt::bits() const', 'Botan::BigInt::operator*=(Botan::BigInt const&)', 'Botan::BigInt::get_bit(unsigned long) const', 'Botan::(anonymous namespace)::inverse_mod_pow2(Botan::BigInt const&, unsigned long)']

2270 4652 Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/mod_inv.cpp:189
1268 2456 36 :

['std::__1::unique_ptr > Botan::(anonymous namespace)::kdf_create_mac_or_hash (std::__1::basic_string_view >)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr > Botan::(anonymous namespace)::kdf_create_mac_or_hash (std::__1::basic_string_view >)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::basic_string_view >::empty() const', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'Botan::MessageAuthenticationCode::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::basic_string , std::__1::allocator > Botan::fmt , std::__1::allocator > >(std::__1::basic_string_view >, std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::unique_ptr >::operator bool() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::unique_ptr > >(std::__1::unique_ptr >&&, std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::operator bool() const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'Botan::HashFunction::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr > Botan::(anonymous namespace)::kdf_create_mac_or_hash (std::__1::basic_string_view >)', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::operator bool() const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)']

1272 2838 Botan::KDF::create(std::__1::basic_string_view >,std::__1::basic_string_view >) call site: 00000 /src/botan/src/lib/kdf/kdf.cpp:126
670 748 12 :

['Botan::BufferSlicer::take(unsigned long)', 'void Botan::load_be (unsigned int*, unsigned char const*, unsigned long)', 'std::__1::vector >::operator[](unsigned long)', 'Botan::SHA1_F::(anonymous namespace)::F1(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'std::__1::span ::data() const', 'std::__1::array ::operator[](unsigned long)', 'std::__1::array ::data()', 'Botan::SHA1_F::(anonymous namespace)::F2(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'Botan::SHA1_F::(anonymous namespace)::F3(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)', 'Botan::BufferSlicer::BufferSlicer(std::__1::span )', 'unsigned int Botan::rotl<1ul, unsigned int>(unsigned int)', 'Botan::SHA1_F::(anonymous namespace)::F4(unsigned int, unsigned int&, unsigned int, unsigned int, unsigned int&, unsigned int)']

670 748 Botan::SHA_1::compress_n(std::__1::vector >&,std::__1::span ,unsignedlong) call site: 00000 /src/botan/src/lib/hash/sha1/sha1.cpp:79
481 640 5 :

['Botan::AES_128::vperm_key_schedule(unsigned char const*, unsigned long)', 'Botan::CPUID::is_little_endian()', 'Botan::(anonymous namespace)::aes_key_schedule(unsigned char const*, unsigned long, std::__1::vector >&, std::__1::vector >&, bool)', 'Botan::CPUID::has_hw_aes()', 'Botan::CPUID::has_vperm()']

481 640 Botan::AES_128::key_schedule(std::__1::span ) call site: 00000 /src/botan/src/lib/block/aes/aes.cpp:850
481 640 5 :

['Botan::AES_256::vperm_key_schedule(unsigned char const*, unsigned long)', 'Botan::CPUID::is_little_endian()', 'Botan::CPUID::has_hw_aes()', 'Botan::(anonymous namespace)::aes_key_schedule(unsigned char const*, unsigned long, std::__1::vector >&, std::__1::vector >&, bool)', 'Botan::CPUID::has_vperm()']

481 640 Botan::AES_256::key_schedule(std::__1::span ) call site: 00000 /src/botan/src/lib/block/aes/aes.cpp:976
459 777 11 :

['Botan::BigInt::~BigInt()', 'Botan::operator-(Botan::BigInt const&, unsigned long)', 'Botan::DH_PublicKey::~DH_PublicKey()', 'Botan::DH_PublicKey::DH_PublicKey(Botan::DL_Group const&, Botan::BigInt const&)', 'Botan::operator>=(Botan::BigInt const&, Botan::BigInt const&)', 'Botan::DL_Group::~DL_Group()', 'Botan::operator<=(Botan::BigInt const&, unsigned long)', 'Botan::DL_Group::get_p() const', 'auto Botan::TLS::Callbacks::tls_ephemeral_key_agreement(std::__1::variant const&, Botan::PK_Key_Agreement_Key const&, std::__1::vector > const&, Botan::RandomNumberGenerator&, Botan::TLS::Policy const&)::$_2::operator() (Botan::PK_Key_Agreement_Key const&, Botan::DH_PublicKey const&) const', 'Botan::(anonymous namespace)::get_dl_group(std::__1::variant const&)', 'Botan::BigInt Botan::BigInt::decode >(std::__1::vector > const&)']

465 794 Botan::TLS::Callbacks::tls_ephemeral_key_agreement(std::__1::variant const&,Botan::PK_Key_Agreement_Keyconst&,std::__1::vector >const&,Botan::RandomNumberGenerator&,Botan::TLS::Policyconst&) call site: 00000 /src/botan/src/lib/tls/tls_callbacks.cpp:295
397 397 3 :

['Botan::(anonymous namespace)::aes_decrypt_n(unsigned char const*, unsigned char*, unsigned long, std::__1::vector > const&)', 'Botan::CPUID::has_vperm()', 'Botan::AES_128::vperm_decrypt_n(unsigned char const*, unsigned char*, unsigned long) const']

397 397 Botan::AES_128::decrypt_n(unsignedcharconst*,unsignedchar*,unsignedlong)const call site: 00000 /src/botan/src/lib/block/aes/aes.cpp:834
397 397 3 :

['Botan::(anonymous namespace)::aes_decrypt_n(unsigned char const*, unsigned char*, unsigned long, std::__1::vector > const&)', 'Botan::AES_256::vperm_decrypt_n(unsigned char const*, unsigned char*, unsigned long) const', 'Botan::CPUID::has_vperm()']

397 397 Botan::AES_256::decrypt_n(unsignedcharconst*,unsignedchar*,unsignedlong)const call site: 00000 /src/botan/src/lib/block/aes/aes.cpp:960
392 392 3 :

['Botan::AES_128::vperm_encrypt_n(unsigned char const*, unsigned char*, unsigned long) const', 'Botan::CPUID::has_vperm()', 'Botan::(anonymous namespace)::aes_encrypt_n(unsigned char const*, unsigned char*, unsigned long, std::__1::vector > const&)']

392 392 Botan::AES_128::encrypt_n(unsignedcharconst*,unsignedchar*,unsignedlong)const call site: 00000 /src/botan/src/lib/block/aes/aes.cpp:816

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fuzz(unsigned char const*, unsigned long) [function] [call site] 00001
2 Botan::TLS::Server_Information::Server_Information(std::__1::basic_string_view<char, std::__1::char_traits<char> >, unsigned short) [function] [call site] 00002
2 fuzzer_rng_as_shared() [function] [call site] 00003
3 __cxa_guard_acquire [call site] 00004
2 Botan::TLS::Server::Server(std::__1::shared_ptr<Botan::TLS::Callbacks> const&, std::__1::shared_ptr<Botan::TLS::Session_Manager> const&, std::__1::shared_ptr<Botan::Credentials_Manager> const&, std::__1::shared_ptr<Botan::TLS::Policy const> const&, std::__1::shared_ptr<Botan::RandomNumberGenerator> const&, bool, unsigned long) [function] [call site] 00005
3 Botan::TLS::Channel::Channel() [function] [call site] 00006
3 Botan::TLS::Protocol_Version::is_pre_tls_13() const [function] [call site] 00007
4 Botan::TLS::Protocol_Version::is_datagram_protocol() const [function] [call site] 00008
5 Botan::TLS::Protocol_Version::major_version() const [function] [call site] 00009
4 Botan::TLS::Protocol_Version::Protocol_Version(Botan::TLS::Version_Code) [function] [call site] 00010
5 Botan::TLS::Protocol_Version::Protocol_Version(unsigned short) [function] [call site] 00011
4 Botan::TLS::Protocol_Version::is_datagram_protocol() const [function] [call site] 00012
4 Botan::TLS::Protocol_Version::Protocol_Version(Botan::TLS::Version_Code) [function] [call site] 00013
3 Botan::TLS::Channel_Impl::expects_downgrade() const [function] [call site] 00014
3 Botan::TLS::Channel_Impl::set_io_buffer_size(unsigned long) [function] [call site] 00015
4 Botan::throw_invalid_state(char const*, char const*, char const*) [function] [call site] 00016
5 __cxa_allocate_exception [call site] 00017
5 std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > Botan::fmt<char const*, char const*, char const*>(std::__1::basic_string_view<char, std::__1::char_traits<char> >, char const* const&, char const* const&, char const* const&) [function] [call site] 00018
6 void Botan::fmt_detail::do_fmt<char const*, char const*, char const*>(std::__1::basic_ostringstream<char, std::__1::char_traits<char>, std::__1::allocator<char> >&, std::__1::basic_string_view<char, std::__1::char_traits<char> >, char const* const&, char const* const&, char const* const&) [function] [call site] 00019
7 void Botan::fmt_detail::do_fmt<char const*, char const*>(std::__1::basic_ostringstream<char, std::__1::char_traits<char>, std::__1::allocator<char> >&, std::__1::basic_string_view<char, std::__1::char_traits<char> >, char const* const&, char const* const&) [function] [call site] 00020
5 Botan::Invalid_State::Invalid_State(std::__1::basic_string_view<char, std::__1::char_traits<char> >) [function] [call site] 00021
6 Botan::Exception::Exception(std::__1::basic_string_view<char, std::__1::char_traits<char> >) [function] [call site] 00022
7 std::exception::exception() [function] [call site] 00023
7 std::exception::~exception() [call site] 00024
3 Botan::TLS::Channel::~Channel() [function] [call site] 00025
2 Botan::TLS::Channel::received_data(unsigned char const*, unsigned long) [function] [call site] 00026
2 __cxa_begin_catch [call site] 00027
2 Botan::TLS::Server::~Server() [function] [call site] 00028
3 Botan::TLS::Channel::~Channel() [function] [call site] 00029
2 Botan::TLS::Server_Information::~Server_Information() [function] [call site] 00030