Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
mp_comba_sqr /src/botan/./src/fuzzer/fuzzers.h 61 150 5 10 172 96 fuzzers.h
mode_padding /src/botan/./src/fuzzer/fuzzers.h 140 435 6 8 310 184 fuzzers.h
uri /src/botan/./src/fuzzer/fuzzers.h 39 97 6 7 180 167 fuzzers.h
redc_p384 /src/botan/./src/fuzzer/fuzzers.h 485 350 13 34 1915 1202 fuzzers.h
bn_sqr /src/botan/./src/fuzzer/fuzzers.h 372 513 11 29 1344 798 fuzzers.h
divide /src/botan/./src/fuzzer/fuzzers.h 423 355 11 28 1650 969 fuzzers.h
redc_p192 /src/botan/./src/fuzzer/fuzzers.h 479 353 13 34 1905 1195 fuzzers.h
invert /src/botan/./src/fuzzer/fuzzers.h 497 454 11 31 2211 1399 fuzzers.h
mp_redc /src/botan/./src/fuzzer/fuzzers.h 106 94 10 14 398 212 fuzzers.h
mp_comba_mul /src/botan/./src/fuzzer/fuzzers.h 47 157 5 10 145 80 fuzzers.h
bn_cmp /src/botan/./src/fuzzer/fuzzers.h 209 456 11 19 812 451 fuzzers.h
redc_p256 /src/botan/./src/fuzzer/fuzzers.h 485 350 13 34 1915 1202 fuzzers.h
redc_p224 /src/botan/./src/fuzzer/fuzzers.h 485 350 13 34 1915 1202 fuzzers.h
pkcs1 /src/botan/./src/fuzzer/fuzzers.h 108 280 6 12 252 183 fuzzers.h
x509_dn /src/botan/./src/fuzzer/fuzzers.h 195 718 10 25 911 675 fuzzers.h
ecc_p384 /src/botan/./src/fuzzer/fuzzers.h 1101 3024 17 67 7321 4701 fuzzers.h
mem_pool /src/botan/./src/fuzzer/fuzzers.h 79 107 10 9 507 333 fuzzers.h
crl /src/botan/./src/fuzzer/fuzzers.h 148 6829 13 25 681 494 fuzzers.h
barrett /src/botan/./src/fuzzer/fuzzers.h 460 345 11 29 1827 1143 fuzzers.h
pow_mod /src/botan/./src/fuzzer/fuzzers.h 560 420 12 38 2222 1387 fuzzers.h
os2ecp /src/botan/./src/fuzzer/fuzzers.h 927 1722 17 58 6345 4081 fuzzers.h
ocsp /src/botan/./src/fuzzer/fuzzers.h 411 6749 14 38 1785 1307 fuzzers.h
x509_path /src/botan/./src/fuzzer/fuzzers.h 851 6676 20 76 6570 4291 fuzzers.h
oaep /src/botan/./src/fuzzer/fuzzers.h 110 340 7 9 348 234 fuzzers.h
gcd /src/botan/./src/fuzzer/fuzzers.h 396 504 11 28 1463 920 fuzzers.h
tls_client_hello /src/botan/./src/fuzzer/fuzzers.h 61 8341 10 10 168 142 fuzzers.h
asn1 /src/botan/./src/fuzzer/fuzzers.h 305 680 16 36 3281 2104 fuzzers.h
ecc_p256 /src/botan/./src/fuzzer/fuzzers.h 1101 3024 17 67 7321 4701 fuzzers.h
tls_13_handshake_layer /src/botan/./src/fuzzer/fuzzers.h 443 8155 10 44 2042 1436 fuzzers.h
cert /src/botan/./src/fuzzer/fuzzers.h 148 6781 13 25 683 497 fuzzers.h
ressol /src/botan/./src/fuzzer/fuzzers.h 742 2681 15 43 3477 2329 fuzzers.h
redc_p521 /src/botan/./src/fuzzer/fuzzers.h 478 353 13 34 1927 1201 fuzzers.h
pkcs8 /src/botan/./src/fuzzer/fuzzers.h 523 6747 18 56 5497 3294 fuzzers.h
tls_client /src/botan/./src/fuzzer/fuzzers.h 85 9495 7 13 319 248 fuzzers.h
ecc_p521 /src/botan/./src/fuzzer/fuzzers.h 1101 3024 17 67 7321 4701 fuzzers.h
ecc_bp256 /src/botan/./src/fuzzer/fuzzers.h 1101 3024 17 67 7321 4701 fuzzers.h
tls_server /src/botan/./src/fuzzer/fuzzers.h 63 9887 7 13 189 156 fuzzers.h

Fuzzer details

Fuzzer: mp_comba_sqr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 20 1.23%
gold [1:9] 0 0.0%
yellow [10:29] 90 5.53%
greenyellow [30:49] 233 14.3%
lawngreen 50+ 1283 78.9%
All colors 1626 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:47

Runtime coverage analysis

Covered functions
23
Functions that are reachable but not covered
18
Reachable functions
61
Percentage of reachable functions covered
70.49%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mp_comba_sqr.cpp 1
/src/botan/src/lib/math/mp/mp_karat.cpp 1
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/public/botan/exceptn.h 1
/src/botan/build/include/public/botan/mem_ops.h 2
/src/botan/build/include/internal/botan/internal/mp_asmi.h 4
/src/botan/src/lib/math/mp/mp_comba.cpp 12
/src/botan/./src/fuzzer/mp_fuzzers.h 2

Fuzzer: mode_padding

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 0 0.0%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 85 100.%
All colors 85 100

Runtime coverage analysis

Covered functions
75
Functions that are reachable but not covered
1
Reachable functions
140
Percentage of reachable functions covered
99.29%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mode_padding.cpp 6
/src/botan/build/include/internal/botan/internal/mode_pad.h 4
/src/botan/src/lib/modes/mode_pad/mode_pad.cpp 4
/src/botan/build/include/internal/botan/internal/ct_utils.h 31
/src/botan/build/include/public/botan/assert.h 3
/src/botan/build/include/internal/botan/internal/bit_ops.h 3
/src/botan/src/lib/tls/tls12/tls_cbc/tls_cbc.cpp 1

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 5 7.93%
gold [1:9] 16 25.3%
yellow [10:29] 9 14.2%
greenyellow [30:49] 4 6.34%
lawngreen 50+ 29 46.0%
All colors 63 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 0 2 Botan::URI::fromIPv4(std::__1::basic_string_view >) call site: 00000 /src/botan/src/lib/utils/socket/uri.cpp:91

Runtime coverage analysis

Covered functions
14
Functions that are reachable but not covered
14
Reachable functions
39
Percentage of reachable functions covered
64.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/uri.cpp 1
/src/botan/src/lib/utils/socket/uri.cpp 8
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/public/botan/exceptn.h 1
/src/botan/build/include/internal/botan/internal/uri.h 2

Fuzzer: redc_p384

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1192 76.1%
gold [1:9] 101 6.45%
yellow [10:29] 0 0.0%
greenyellow [30:49] 10 0.63%
lawngreen 50+ 262 16.7%
All colors 1565 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
193 193 2 :

['Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)', 'Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)']

193 226 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:345
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul4(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:298
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
178
Functions that are reachable but not covered
153
Reachable functions
485
Percentage of reachable functions covered
68.45%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p384.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 14
/src/botan/build/include/public/botan/bigint.h 51
/src/botan/build/include/public/botan/mem_ops.h 9
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/internal/botan/internal/ct_utils.h 28
/src/botan/build/include/internal/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/public/botan/exceptn.h 2
/src/botan/build/include/public/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/public/botan/assert.h 3
/src/botan/build/include/internal/botan/internal/mp_core.h 17
/src/botan/build/include/internal/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/internal/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/public/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/public/botan/hex.h 1

Fuzzer: bn_sqr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 117 6.25%
gold [1:9] 298 15.9%
yellow [10:29] 320 17.1%
greenyellow [30:49] 3 0.16%
lawngreen 50+ 1133 60.5%
All colors 1871 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_sqr(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:47
0 22 1 :

['Botan::bigint_add3_nc(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)']

0 22 Botan::bigint_add3_nc(unsignedlong*,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/build/include/internal/botan/internal/mp_core.h:229
0 10 1 :

['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']

0 10 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:296
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/allocator.cpp:27
0 0 None 0 331 Botan::operator*(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/bigint/big_ops3.cpp:54
0 0 None 0 33 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:315
0 0 None 0 10 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:294
0 0 None 0 8 Botan::bigint_ct_is_eq(unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/build/include/internal/botan/internal/mp_core.h:578

Runtime coverage analysis

Covered functions
132
Functions that are reachable but not covered
125
Reachable functions
372
Percentage of reachable functions covered
66.4%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/bn_sqr.cpp 1
/src/botan/build/include/public/botan/bigint.h 37
/src/botan/src/lib/math/bigint/bigint.cpp 10
/src/botan/build/include/public/botan/mem_ops.h 5
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 4
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/src/lib/math/numbertheory/numthry.cpp 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 2
/src/botan/build/include/internal/botan/internal/ct_utils.h 19
/src/botan/build/include/public/botan/assert.h 2
/src/botan/build/include/internal/botan/internal/bit_ops.h 4
/src/botan/src/lib/math/mp/mp_karat.cpp 20
/src/botan/build/include/internal/botan/internal/mp_core.h 10
/src/botan/build/include/internal/botan/internal/mp_asmi.h 12
/src/botan/src/lib/math/mp/mp_comba.cpp 12
/src/botan/build/include/public/botan/exceptn.h 1
/src/botan/src/lib/math/bigint/big_ops3.cpp 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/src/lib/math/bigint/big_code.cpp 2
/src/botan/src/lib/math/bigint/divide.cpp 1
/src/botan/build/include/public/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3

Fuzzer: divide

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 83 5.69%
gold [1:9] 24 1.64%
yellow [10:29] 1040 71.3%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 311 21.3%
All colors 1458 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
182 182 2 :

['Botan::BigInt::flip_sign()', 'Botan::BigInt::operator--()']

182 194 Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:105
114 114 1 :

['Botan::bigint_sub_abs(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long)']

114 155 Botan::BigInt::add2(Botan::BigIntconst&,unsignedlongconst*,unsignedlong,Botan::BigInt::Sign) call site: 00000 /src/botan/src/lib/math/bigint/big_ops3.cpp:24
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', '__cxa_free_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::bigint_divop_vartime(unsignedlong,unsignedlong,unsignedlong) call site: 00000 /src/botan/build/include/internal/botan/internal/mp_core.h:666
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::BigInt::reduce_below(Botan::BigIntconst&,std::__1::vector >&) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:313
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::ct_divide_word(Botan::BigIntconst&,unsignedlong,Botan::BigInt&,unsignedlong&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:81
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::vartime_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:156
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
0 10 1 :

['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']

0 10 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:296
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/allocator.cpp:27
0 0 None 0 84 Botan::BigInt::is_less_than(Botan::BigIntconst&)const call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:180
0 0 None 0 33 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:315

Runtime coverage analysis

Covered functions
178
Functions that are reachable but not covered
94
Reachable functions
423
Percentage of reachable functions covered
77.78%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/divide.cpp 1
/src/botan/build/include/public/botan/bigint.h 44
/src/botan/src/lib/math/bigint/bigint.cpp 16
/src/botan/build/include/public/botan/mem_ops.h 6
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 4
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/build/include/internal/botan/internal/ct_utils.h 21
/src/botan/build/include/public/botan/assert.h 2
/src/botan/build/include/internal/botan/internal/bit_ops.h 4
/src/botan/build/include/internal/botan/internal/mp_core.h 18
/src/botan/src/lib/math/bigint/divide.cpp 5
/src/botan/build/include/public/botan/exceptn.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 4
/src/botan/src/lib/math/bigint/big_ops3.cpp 4
/src/botan/build/include/internal/botan/internal/mp_asmi.h 12
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/src/lib/math/bigint/big_code.cpp 2
/src/botan/build/include/public/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3

Fuzzer: redc_p192

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1211 78.1%
gold [1:9] 65 4.19%
yellow [10:29] 0 0.0%
greenyellow [30:49] 14 0.90%
lawngreen 50+ 259 16.7%
All colors 1549 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
193 193 2 :

['Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)', 'Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)']

193 226 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:345
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:300
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
173
Functions that are reachable but not covered
157
Reachable functions
479
Percentage of reachable functions covered
67.22%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p192.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 14
/src/botan/build/include/public/botan/bigint.h 51
/src/botan/build/include/public/botan/mem_ops.h 9
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/internal/botan/internal/ct_utils.h 27
/src/botan/build/include/internal/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/public/botan/exceptn.h 2
/src/botan/build/include/public/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/public/botan/assert.h 3
/src/botan/build/include/internal/botan/internal/mp_core.h 17
/src/botan/build/include/internal/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/internal/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/public/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/public/botan/hex.h 1

Fuzzer: invert

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 163 9.86%
gold [1:9] 1 0.06%
yellow [10:29] 124 7.50%
greenyellow [30:49] 641 38.8%
lawngreen 50+ 723 43.7%
All colors 1652 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::BigInt::ct_cond_add(bool,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:425
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::ct_modulo(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:118
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/mod_inv.cpp:182
0 10 1 :

['Botan::bigint_linmul3(unsigned long*, unsigned long const*, unsigned long, unsigned long)']

0 10 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:296
0 6 1 :

['Botan::BigInt::Data::set_to_zero()']

0 6 Botan::BigInt::Data::mask_bits(unsignedlong) call site: 00000 /src/botan/build/include/public/botan/bigint.h:884
0 0 None 17 17 Botan::inverse_mod(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/mod_inv.cpp:179
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/allocator.cpp:27
0 0 None 0 185 Botan::operator>>(Botan::BigIntconst&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/big_ops3.cpp:193
0 0 None 0 84 Botan::BigInt::is_less_than(Botan::BigIntconst&)const call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:180
0 0 None 0 48 Botan::BigInt::cmp(Botan::BigIntconst&,bool)const call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:155
0 0 None 0 10 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:294

Runtime coverage analysis

Covered functions
207
Functions that are reachable but not covered
106
Reachable functions
497
Percentage of reachable functions covered
78.67%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/invert.cpp 2
/src/botan/build/include/public/botan/bigint.h 58
/src/botan/src/lib/math/bigint/bigint.cpp 22
/src/botan/build/include/public/botan/mem_ops.h 6
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 4
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/build/include/internal/botan/internal/ct_utils.h 29
/src/botan/build/include/public/botan/assert.h 3
/src/botan/build/include/internal/botan/internal/bit_ops.h 6
/src/botan/build/include/internal/botan/internal/mp_core.h 22
/src/botan/src/lib/math/numbertheory/mod_inv.cpp 3
/src/botan/build/include/public/botan/exceptn.h 1
/src/botan/build/include/internal/botan/internal/mp_asmi.h 12
/src/botan/src/lib/math/bigint/divide.cpp 2
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/src/lib/math/bigint/big_ops3.cpp 3
/src/botan/src/lib/math/numbertheory/numthry.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/src/lib/math/bigint/big_code.cpp 2
/src/botan/build/include/public/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3
/src/botan/build/include/public/botan/numthry.h 1

Fuzzer: mp_redc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 31 1.38%
gold [1:9] 2177 97.5%
yellow [10:29] 14 0.62%
greenyellow [30:49] 3 0.13%
lawngreen 50+ 6 0.26%
All colors 2231 100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
17 67 void (anonymous namespace)::fuzz_mp_redc<4ul>(unsigned char const*, unsigned long) call site: 00067 fprintf
8 29 Botan::bigint_sub3(unsigned long*, unsigned long const*, unsigned long, unsigned long const*, unsigned long) call site: 00029 __cxa_allocate_exception
6 54 Botan::bigint_monty_redc_generic(unsigned long*, unsigned long, unsigned long const*, unsigned long, unsigned long, unsigned long*) call site: 00054 __cxa_allocate_exception

Runtime coverage analysis

Covered functions
35
Functions that are reachable but not covered
40
Reachable functions
106
Percentage of reachable functions covered
62.26%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mp_redc.cpp 7
/src/botan/src/lib/math/mp/mp_monty_n.cpp 6
/src/botan/build/include/internal/botan/internal/mp_asmi.h 4
/src/botan/build/include/internal/botan/internal/mp_core.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/src/lib/utils/exceptn.cpp 4
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/fmt.h 4
/src/botan/build/include/internal/botan/internal/ct_utils.h 7
/src/botan/build/include/internal/botan/internal/bit_ops.h 3
/src/botan/build/include/public/botan/mem_ops.h 2
/src/botan/src/lib/math/mp/mp_monty.cpp 1
/src/botan/./src/fuzzer/mp_fuzzers.h 2

Fuzzer: mp_comba_mul

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 20 1.87%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 122 11.4%
lawngreen 50+ 926 86.7%
All colors 1068 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21

Runtime coverage analysis

Covered functions
16
Functions that are reachable but not covered
18
Reachable functions
47
Percentage of reachable functions covered
61.7%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/mp_comba_mul.cpp 1
/src/botan/src/lib/math/mp/mp_karat.cpp 1
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/public/botan/exceptn.h 1
/src/botan/build/include/public/botan/mem_ops.h 2
/src/botan/build/include/internal/botan/internal/mp_asmi.h 3
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/./src/fuzzer/mp_fuzzers.h 2

Fuzzer: bn_cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 16 9.58%
gold [1:9] 6 3.59%
yellow [10:29] 1 0.59%
greenyellow [30:49] 3 1.79%
lawngreen 50+ 141 84.4%
All colors 167 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/allocator.cpp:27

Runtime coverage analysis

Covered functions
93
Functions that are reachable but not covered
42
Reachable functions
209
Percentage of reachable functions covered
79.9%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/bn_cmp.cpp 1
/src/botan/build/include/public/botan/bigint.h 29
/src/botan/src/lib/math/bigint/bigint.cpp 6
/src/botan/build/include/public/botan/mem_ops.h 5
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 4
/src/botan/src/lib/utils/exceptn.cpp 4
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/src/lib/math/bigint/big_ops3.cpp 1
/src/botan/build/include/internal/botan/internal/ct_utils.h 13
/src/botan/build/include/public/botan/assert.h 2
/src/botan/build/include/internal/botan/internal/bit_ops.h 3
/src/botan/build/include/internal/botan/internal/mp_core.h 6
/src/botan/build/include/internal/botan/internal/mp_asmi.h 4

Fuzzer: redc_p256

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1211 77.8%
gold [1:9] 85 5.46%
yellow [10:29] 0 0.0%
greenyellow [30:49] 1 0.06%
lawngreen 50+ 259 16.6%
All colors 1556 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
193 193 2 :

['Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)', 'Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)']

193 226 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:345
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:300
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
176
Functions that are reachable but not covered
157
Reachable functions
485
Percentage of reachable functions covered
67.63%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p256.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 14
/src/botan/build/include/public/botan/bigint.h 51
/src/botan/build/include/public/botan/mem_ops.h 9
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/internal/botan/internal/ct_utils.h 28
/src/botan/build/include/internal/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/public/botan/exceptn.h 2
/src/botan/build/include/public/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/public/botan/assert.h 3
/src/botan/build/include/internal/botan/internal/mp_core.h 17
/src/botan/build/include/internal/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/internal/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/public/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/public/botan/hex.h 1

Fuzzer: redc_p224

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1211 77.9%
gold [1:9] 82 5.28%
yellow [10:29] 0 0.0%
greenyellow [30:49] 3 0.19%
lawngreen 50+ 257 16.5%
All colors 1553 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
193 193 2 :

['Botan::(anonymous namespace)::karatsuba_size(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)', 'Botan::(anonymous namespace)::karatsuba_mul(unsigned long*, unsigned long const*, unsigned long const*, unsigned long, unsigned long*)']

193 226 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:310
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 25 Botan::Modular_Reducer::Modular_Reducer(Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:20
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::BigInt::ct_reduce_below(Botan::BigIntconst&,std::__1::vector >&,unsignedlong) call site: 00000 /src/botan/src/lib/math/bigint/bigint.cpp:345
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::ct_divide(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigInt&,Botan::BigInt&) call site: 00000 /src/botan/src/lib/math/bigint/divide.cpp:49
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception', 'Botan::Invalid_Argument::Invalid_Argument(std::__1::basic_string_view >)']

17 17 Botan::basecase_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlongconst*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:21
17 17 5 :

['__cxa_throw', '__cxa_allocate_exception', 'Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)', 'std::__1::basic_string_view >::basic_string_view(char const*)', '__cxa_free_exception']

17 17 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:73
4 4 1 :

['Botan::bigint_comba_mul6(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:300
4 4 1 :

['Botan::bigint_comba_mul8(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:302
4 4 1 :

['Botan::bigint_comba_mul9(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:304
4 4 1 :

['Botan::bigint_comba_mul16(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:306
4 4 1 :

['Botan::bigint_comba_mul24(unsigned long*, unsigned long const*, unsigned long const*)']

4 4 Botan::bigint_mul(unsignedlong*,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlongconst*,unsignedlong,unsignedlong,unsignedlong*,unsignedlong) call site: 00000 /src/botan/src/lib/math/mp/mp_karat.cpp:308

Runtime coverage analysis

Covered functions
176
Functions that are reachable but not covered
157
Reachable functions
485
Percentage of reachable functions covered
67.63%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/redc_p224.cpp 1
/src/botan/src/lib/math/numbertheory/nistp_redc.cpp 4
/src/botan/src/lib/math/bigint/bigint.cpp 14
/src/botan/build/include/public/botan/bigint.h 51
/src/botan/build/include/public/botan/mem_ops.h 9
/src/botan/src/lib/math/bigint/big_code.cpp 3
/src/botan/build/include/internal/botan/internal/rounding.h 1
/src/botan/src/lib/utils/assert.cpp 2
/src/botan/build/include/internal/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 5
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/internal/botan/internal/loadstor.h 2
/src/botan/build/include/public/botan/concepts.h 3
/src/botan/build/include/internal/botan/internal/bswap.h 1
/src/botan/src/lib/codec/hex/hex.cpp 7
/src/botan/build/include/internal/botan/internal/ct_utils.h 27
/src/botan/build/include/internal/botan/internal/bit_ops.h 5
/src/botan/src/lib/utils/charset.cpp 1
/src/botan/build/include/public/botan/exceptn.h 2
/src/botan/build/include/public/botan/secmem.h 1
/src/botan/src/lib/math/bigint/big_ops2.cpp 5
/src/botan/build/include/public/botan/assert.h 3
/src/botan/build/include/internal/botan/internal/mp_core.h 17
/src/botan/build/include/internal/botan/internal/mp_asmi.h 13
/src/botan/src/lib/math/bigint/big_ops3.cpp 2
/src/botan/src/lib/math/mp/mp_karat.cpp 10
/src/botan/src/lib/math/mp/mp_comba.cpp 6
/src/botan/src/lib/math/numbertheory/reducer.cpp 4
/src/botan/build/include/internal/botan/internal/divide.h 1
/src/botan/src/lib/math/bigint/divide.cpp 4
/src/botan/build/include/public/botan/reducer.h 1
/src/botan/src/lib/math/bigint/big_io.cpp 1
/src/botan/build/include/public/botan/hex.h 1

Fuzzer: pkcs1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 14 19.7%
gold [1:9] 3 4.22%
yellow [10:29] 6 8.45%
greenyellow [30:49] 3 4.22%
lawngreen 50+ 45 63.3%
All colors 71 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/allocator.cpp:27

Runtime coverage analysis

Covered functions
54
Functions that are reachable but not covered
26
Reachable functions
108
Percentage of reachable functions covered
75.93%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/pkcs1.cpp 2
/src/botan/src/lib/pk_pad/eme_pkcs1/eme_pkcs.cpp 1
/src/botan/build/include/internal/botan/internal/ct_utils.h 20
/src/botan/build/include/public/botan/assert.h 3
/src/botan/build/include/internal/botan/internal/bit_ops.h 4
/src/botan/src/lib/utils/ct_utils.cpp 1
/src/botan/src/lib/utils/exceptn.cpp 2
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/public/botan/exceptn.h 1
/src/botan/build/include/public/botan/hex.h 1
/src/botan/src/lib/codec/hex/hex.cpp 3

Fuzzer: x509_dn

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 39 21.0%
gold [1:9] 3 1.62%
yellow [10:29] 15 8.10%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 128 69.1%
All colors 185 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
11 11 1 :

['Botan::Invalid_State::Invalid_State(std::__1::basic_string_view >)']

17 17 Botan::BER_Decoder::end_cons() call site: 00000 /src/botan/src/lib/asn1/ber_dec.cpp:296
0 0 None 16 320 Botan::BER_Decoder::get_next_object() call site: 00000 /src/botan/src/lib/asn1/ber_dec.cpp:255
0 0 None 8 8 Botan::allocate_memory(unsignedlong,unsignedlong) call site: 00000 /src/botan/src/lib/utils/allocator.cpp:27
0 0 4 :

['std::__1::basic_string_view >::size() const', 'std::__1::basic_string_view >::operator[](unsigned long) const', 'std::__1::basic_ostream >& std::__1::operator<< >(std::__1::basic_ostream >&, char)', 'std::__1::basic_string_view >::at(unsigned long) const']

0 9 voidBotan::fmt_detail::do_fmt >,unsignedint>(std::__1::basic_ostringstream ,std::__1::allocator >&,std::__1::basic_string_view >,std::__1::basic_string_view >const&,unsignedintconst&) call site: 00000 /src/botan/build/include/internal/botan/internal/fmt.h:29
0 0 None 0 0 Botan::ASN1_String::ASN1_String(std::__1::basic_string_view >,Botan::ASN1_Type) call site: 00000 /src/botan/src/lib/asn1/asn1_str.cpp:65
0 0 None 0 0 Botan::(anonymousnamespace)::choose_encoding(std::__1::basic_string_view >) call site: 00000 /src/botan/src/lib/asn1/asn1_str.cpp:40

Runtime coverage analysis

Covered functions
131
Functions that are reachable but not covered
58
Reachable functions
195
Percentage of reachable functions covered
70.26%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/botan/./src/fuzzer/fuzzers.h 1
/src/botan/./src/fuzzer/x509_dn.cpp 1
/src/botan/build/include/public/botan/pkix_types.h 2
/src/botan/build/include/public/botan/asn1_obj.h 16
/src/botan/src/lib/asn1/ber_dec.cpp 11
/src/botan/src/lib/x509/x509_dn.cpp 8
/src/botan/build/include/public/botan/ber_dec.h 3
/src/botan/src/lib/utils/data_src.cpp 2
/src/botan/src/lib/asn1/asn1_obj.cpp 6
/src/botan/build/include/internal/botan/internal/fmt.h 5
/src/botan/src/lib/utils/exceptn.cpp 4
/usr/local/bin/../include/c++/v1/exception 1
/src/botan/build/include/public/botan/exceptn.h 2
/src/botan/build/include/public/botan/secmem.h 1
/src/botan/build/include/public/botan/data_src.h 3
/src/botan/build/include/internal/botan/internal/loadstor.h 1
/src/botan/build/include/internal/botan/internal/safeint.h 2
/src/botan/src/lib/asn1/asn1_str.cpp 2
/src/botan/build/include/internal/botan/internal/ct_utils.h 10
/src/botan/build/include/public/botan/assert.h 2
/src/botan/build/include/internal/botan/internal/bit_ops.h 1
/src/botan/build/include/internal/botan/internal/stl_util.h 1
/usr/include/ctype.h 2
/src/botan/src/lib/asn1/asn1_oid.cpp 1
/src/botan/src/lib/utils/assert.cpp 1

Fuzzer: ecc_p384

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 3009 70.7%
gold [1:9] 301 7.07%
yellow [10:29] 2 0.04%
greenyellow [30:49] 65 1.52%
lawngreen 50+ 879 20.6%
All colors 4256 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2729 2729 10 :

['std::__1::basic_string_view >::substr(unsigned long, unsigned long) const', 'std::__1::basic_string_view >::size() const', 'Botan::EC_Group::BER_decode_EC_group(unsigned char const*, unsigned long, Botan::EC_Group_Source)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::vector >::data()', 'Botan::PEM_Code::decode_check_label(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::shared_ptr ::operator=(std::__1::shared_ptr const&)', 'std::__1::vector >::~vector()', 'std::__1::pair , bool>::~pair()', 'std::__1::vector >::size() const']

2749 2760 Botan::EC_Group::EC_Group(std::__1::basic_string_view >) call site: 00000 /src/botan/src/lib/pubkey/ec_group/ec_group.cpp:421
425 464 8 :

['std::__1::shared_ptr ::shared_ptr (std::__1::shared_ptr &&)', 'std::__1::shared_ptr ::~shared_ptr()', 'Botan::operator==(Botan::BigInt const&, Botan::BigInt const&)', 'std::__1::shared_ptr std::__1::make_shared (Botan::BigInt const&, Botan::BigInt const&, Botan::BigInt const&)', 'Botan::prime_p521()', 'std::__1::shared_ptr std::__1::make_shared (Botan::BigInt const&, Botan::BigInt const&)', 'std::__1::shared_ptr ::~shared_ptr()', 'std::__1::shared_ptr ::shared_ptr (std::__1::shared_ptr &&)']

425 464 Botan::CurveGFp::choose_repr(Botan::BigIntconst&,Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/pubkey/ec_group/curve_gfp.cpp:574
318 372 22 :

['Botan::SCAN_Name::arg(unsigned long) const', 'Botan::SCAN_Name::algo_name() const', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'void Botan::ignore_params (Botan::SCAN_Name const&)', 'std::__1::unique_ptr >::operator bool() const', 'std::__1::basic_string_view >::empty() const', 'Botan::BlockCipher::create(std::__1::basic_string_view >, std::__1::basic_string_view >)', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::basic_string_view >::basic_string_view(char const*)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique > >(std::__1::unique_ptr >&&)', 'void Botan::ignore_params >&>(std::__1::basic_string_view >&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long const&)']

322 437 Botan::StreamCipher::create(std::__1::basic_string_view >,std::__1::basic_string_view >) call site: 00000 /src/botan/src/lib/stream/stream_cipher.cpp:87
299 314 3 :

['Botan::BigInt::~BigInt()', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::ct_modulo(Botan::BigInt const&, Botan::BigInt const&)']

299 314 Botan::Modular_Reducer::reduce(Botan::BigInt&,Botan::BigIntconst&,std::__1::vector >&)const call site: 00000 /src/botan/src/lib/math/numbertheory/reducer.cpp:79
290 6376 18 :

['Botan::operator-(Botan::BigInt const&, unsigned long)', 'Botan::Modular_Reducer::square(Botan::BigInt const&) const', 'Botan::assertion_failure(char const*, char const*, char const*, char const*, int)', 'Botan::BigInt::from_word(unsigned long)', 'Botan::low_zero_bits(Botan::BigInt const&)', 'Botan::operator<<(Botan::BigInt const&, unsigned long)', 'Botan::operator!=(Botan::BigInt const&, unsigned long)', 'Botan::BigInt::operator-=(unsigned long)', 'Botan::BigInt::operator=(Botan::BigInt const&)', 'Botan::BigInt::from_s32(int)', 'Botan::BigInt::operator=(Botan::BigInt&&)', 'Botan::BigInt::operator>>=(unsigned long)', 'Botan::operator>(Botan::BigInt const&, unsigned long)', 'Botan::operator==(Botan::BigInt const&, unsigned long)', 'Botan::Modular_Reducer::multiply(Botan::BigInt const&, Botan::BigInt const&) const', 'Botan::BigInt::BigInt(Botan::BigInt&&)', 'Botan::BigInt::power_of_2(unsigned long)', 'Botan::jacobi(Botan::BigInt const&, Botan::BigInt const&)']

302 8579 Botan::sqrt_modulo_prime(Botan::BigIntconst&,Botan::BigIntconst&) call site: 00000 /src/botan/src/lib/math/numbertheory/numthry.cpp:46
267 1894 90 :

['Botan::SCAN_Name::arg(unsigned long) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::vector >, std::__1::allocator > > >::vector()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (int&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'bool std::__1::operator== , 1>(std::__1::basic_string_view >, std::__1::common_type > >::type)', 'std::__1::vector >, std::__1::allocator > > >::push_back(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::remove_reference >&>::type&& std::__1::move >&>(std::__1::unique_ptr >&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, std::__1::allocator > > >&>(std::__1::vector >, std::__1::allocator > > >&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::SCAN_Name(std::__1::basic_string_view >)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'bool std::__1::operator== , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'Botan::SCAN_Name::~SCAN_Name()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique , std::__1::allocator > >(unsigned long&&, std::__1::basic_string , std::__1::allocator >&&)', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::SCAN_Name::arg_count() const', 'std::__1::unique_ptr >::operator bool() const', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::basic_string , std::__1::allocator >::operator std::__1::basic_string_view >() const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'Botan::SCAN_Name::algo_name() const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique >, unsigned long>(std::__1::unique_ptr >&&, unsigned long&&)', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::__unique_if ::__unique_single std::__1::make_unique ()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'Botan::SCAN_Name::arg_as_integer(unsigned long, unsigned long) const', 'Botan::SCAN_Name::arg(unsigned long, std::__1::basic_string_view >) const', 'std::__1::__unique_if ::__unique_single std::__1::make_unique (unsigned long&&)', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::~unique_ptr()', 'std::__1::unique_ptr >::unique_ptr , void, void>(std::__1::unique_ptr >&&)', 'Botan::HashFunction::create(std::__1::basic_string_view