High level conclusions

Fuzzers reach 62.50% of cyclomatic complexity.

Fuzzers reach 60.35% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

472/782

Cyclomatic complexity statically reachable by fuzzers

3111/4977

Runtime code coverage of functions

560 / 782

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzzer-preauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	500	46.8%
gold	[1:9]	183	17.1%
yellow	[10:29]	17	1.59%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	366	34.3%
All colors	1067	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4463	4895	16 : View List ['kexecdh_comb_key', 'encrypt_packet', 'gen_kexdh_param', 'free_kexcurve25519_param', 'free_kexdh_param', 'free_kexecdh_param', 'buf_put_sign', 'gen_kexecdh_param', 'kexcurve25519_comb_key', 'buf_putstring', 'kexdh_comb_key', 'buf_putmpint', 'gen_kexcurve25519_param', 'buf_putbyte', 'buf_put_ecc_raw_pubkey_string', 'buf_put_pub_key']	4463	4895	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:203
1770	1770	1 : View List ['svr_ensure_hostkey']	6233	6726	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:196
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	550	564	checktimeouts	call site: 00879	/src/dropbear/src/common-session.c:555
330	330	1 : View List ['checkpubkey']	2740	3991	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:162
270	272	2 : View List ['send_msg_userauth_success', 'dropbear_log']	270	299	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:126
270	270	1 : View List ['send_msg_userauth_success']	270	554	svr_auth_password	call site: 00000	/src/dropbear/src/svr-authpasswd.c:108
265	276	2 : View List ['buf_free', 'send_msg_userauth_banner']	543	3367	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:91
263	263	1 : View List ['send_msg_userauth_pk_ok']	314	356	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:172
84	88	6 : View List ['getpeername', '__errno_location', 'getaddrstring', 'dropbear_exit', 'strerror', 'getsockname']	84	88	get_socket_address	call site: 00640	/src/dropbear/src/netio.c:618
69	87	4 : View List ['buf_setpos', 'stat', 'buf_new', 'buf_readfile']	144	184	svr_getopts	call site: 00268	/src/dropbear/src/svr-runopts.c:375
51	51	1 : View List ['sign_key_free']	51	73	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:255
38	38	1 : View List ['hash_memory']	38	53	hmac_init	call site: 00772	/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c:57

Runtime coverage analysis

Covered functions

263

Functions that are reachable but not covered

126

Reachable functions

319

Percentage of reachable functions covered

60.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-preauth_nomaths.c	1
fuzz/fuzz-common.c	11
src/dbutil.c	14
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
fuzz/fuzz-wrapfd.c	8
src/buffer.c	23
src/dbhelpers.c	1
src/ecc.c	4
src/svr-session.c	5
src/common-session.c	14
src/common-channel.c	16
src/circbuffer.c	5
src/netio.c	13
src/listener.c	5
src/list.c	1
src/queue.c	5
libtommath/bn_mp_clear.c	1
src/signkey.c	6
src/dss.c	3
src/bignum.c	2
src/rsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
src/ed25519.c	2
src/svr-runopts.c	4
src/common-runopts.c	3
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/ecdsa.c	3
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/svr-auth.c	1
src/svr-chansession.c	3
src/svr-authpubkeyoptions.c	1
src/packet.c	11
src/common-kex.c	3
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-kexcurve25519

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	75	32.8%
gold	[1:9]	2	0.87%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	10	4.38%
lawngreen	50+	141	61.8%
All colors	228	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
156	156	1 : View List ['buf_put_dss_pub_key']	364	429	buf_put_pub_key	call site: 00126	/src/dropbear/src/signkey.c:427
156	156	1 : View List ['buf_put_rsa_pub_key']	208	273	buf_put_pub_key	call site: 00127	/src/dropbear/src/signkey.c:432
69	87	4 : View List ['buf_setpos', 'stat', 'buf_new', 'buf_readfile']	144	184	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:375
52	65	2 : View List ['signkey_key_ptr', 'buf_put_ecdsa_pub_key']	52	114	buf_put_pub_key	call site: 00171	/src/dropbear/src/signkey.c:437
21	21	1 : View List ['parse_recv_window']	73	87	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:407
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	dss_key_free	call site: 00000	/src/dropbear/src/dss.c:125
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	rsa_key_free	call site: 00000	/src/dropbear/src/rsa.c:146
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_dss_priv_key	call site: 00000	/src/dropbear/src/dss.c:113
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_rsa_priv_key	call site: 00000	/src/dropbear/src/rsa.c:133
15	27	5 : View List ['getuid', 'strlen', 'm_malloc', 'fuzz_getpwuid', 'getenv']	15	43	expand_homedir_path	call site: 00000	/src/dropbear/src/dbutil.c:640
13	13	1 : View List ['m_str_to_uint']	13	19	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:441
12	21	2 : View List ['m_free_direct', 'ecc_free']	12	21	buf_get_ecc_raw_pubkey	call site: 00000	/src/dropbear/src/ecc.c:201

Runtime coverage analysis

Covered functions

138

Functions that are reachable but not covered

23

Reachable functions

100

Percentage of reachable functions covered

77.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-kexcurve25519.c	1
fuzz/fuzz-common.c	1
fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	10
src/buffer.c	20
src/dbutil.c	3
src/common-kex.c	2
src/curve25519.c	10
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/dbhelpers.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1

Fuzzer: fuzzer-verify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	190	21.1%
gold	[1:9]	41	4.57%
yellow	[10:29]	8	0.89%
greenyellow	[30:49]	8	0.89%
lawngreen	50+	650	72.4%
All colors	897	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
242	242	1 : View List ['buf_sk_ecdsa_verify']	242	536	buf_verify	call site: 00656	/src/dropbear/src/signkey.c:694
47	1193	5 : View List ['mp_exptmod', 'mp_invmod', 'mp_abs', 'mp_clear_multi', 'mp_init_multi']	47	1193	mp_exptmod	call site: 00516	/src/dropbear/libtommath/bn_mp_exptmod.c:21
2	2	1 : View List ['exit']	2	2	generic_dropbear_exit	call site: 00000	/src/dropbear/src/dbutil.c:124
0	258	2 : View List ['mp_set', 'mp_mod']	0	1362	s_mp_exptmod_fast	call site: 00574	/src/dropbear/libtommath/bn_s_mp_exptmod_fast.c:122
0	222	1 : View List ['mp_mul']	0	643	mp_reduce	call site: 00000	/src/dropbear/libtommath/bn_mp_reduce.c:25
0	214	3 : View List ['mp_cmp', 'mp_set', 'mp_read_radix']	0	981	mp_prime_is_prime	call site: 00856	/src/dropbear/libtommath/bn_mp_prime_is_prime.c:147
0	100	5 : View List ['mp_cmp_mag', 'mp_rshd', 'mp_clamp', 's_mp_sub', 'mp_grow']	0	100	mp_montgomery_reduce	call site: 00000	/src/dropbear/libtommath/bn_mp_montgomery_reduce.c:20
0	77	1 : View List ['ltc_ecc_projective_dbl_point']	0	81	ltc_ecc_projective_add_point	call site: 00000	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c:51
0	74	1 : View List ['mp_add_d']	0	79	mp_sub_d	call site: 00269	/src/dropbear/libtommath/bn_mp_sub_d.c:23
0	43	1 : View List ['mp_copy']	0	43	mp_div_d	call site: 00798	/src/dropbear/libtommath/bn_mp_div_d.c:21
0	41	1 : View List ['mp_lshd']	0	46	mp_mul_2d	call site: 00185	/src/dropbear/libtommath/bn_mp_mul_2d.c:26
0	40	4 : View List ['mp_clear', 'mp_exch', 'mp_init_size', 'mp_clamp']	0	40	s_mp_mul_digs	call site: 00364	/src/dropbear/libtommath/bn_s_mp_mul_digs.c:20

Runtime coverage analysis

Covered functions

238

Functions that are reachable but not covered

43

Reachable functions

242

Percentage of reachable functions covered

82.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-verify.c	2
fuzz/fuzz-common.c	3
src/dbutil.c	4
src/dbmalloc.c	11
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	2
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
fuzz/fuzz-wrapfd.c	5
src/buffer.c	20
src/dbhelpers.c	1
src/ecc.c	5
src/signkey.c	9
src/dss.c	3
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	4
src/ecdsa.c	4
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	3
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/curve25519.c	24
libtomcrypt/src/hashes/sha2/sha512.c	4
src/sk-ecdsa.c	1
src/sk-ed25519.c	1
libtommath/bn_mp_prime_rabin_miller_trials.c	1
libtommath/bn_mp_prime_is_prime.c	2
libtommath/bn_mp_is_square.c	1
libtommath/bn_mp_mod_d.c	1
libtommath/bn_mp_div_d.c	1
libtommath/bn_mp_div_3.c	1
libtommath/bn_mp_init_u32.c	1
libtommath/bn_mp_set_u32.c	1
libtommath/bn_mp_get_i32.c	1
libtommath/bn_mp_get_mag_u32.c	1
libtommath/bn_mp_sqrt.c	1
libtommath/bn_s_mp_prime_is_divisible.c	1
libtommath/bn_mp_init_set.c	1
libtommath/bn_mp_prime_miller_rabin.c	1
libtommath/bn_mp_cnt_lsb.c	1
libtommath/bn_mp_sqrmod.c	1

Fuzzer: fuzzer-preauth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	482	45.1%
gold	[1:9]	149	13.9%
yellow	[10:29]	2	0.18%
greenyellow	[30:49]	7	0.65%
lawngreen	50+	427	40.0%
All colors	1067	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1770	1770	1 : View List ['svr_ensure_hostkey']	1854	6726	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:196
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	550	564	checktimeouts	call site: 00879	/src/dropbear/src/common-session.c:555
330	330	1 : View List ['checkpubkey']	2740	3991	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:162
270	270	1 : View List ['send_msg_userauth_success']	270	554	svr_auth_password	call site: 00000	/src/dropbear/src/svr-authpasswd.c:108
265	276	2 : View List ['buf_free', 'send_msg_userauth_banner']	543	3367	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:91
263	263	1 : View List ['send_msg_userauth_pk_ok']	314	356	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:172
84	88	6 : View List ['getpeername', '__errno_location', 'getaddrstring', 'dropbear_exit', 'strerror', 'getsockname']	84	88	get_socket_address	call site: 00640	/src/dropbear/src/netio.c:618
69	87	4 : View List ['buf_setpos', 'stat', 'buf_new', 'buf_readfile']	144	184	svr_getopts	call site: 00268	/src/dropbear/src/svr-runopts.c:375
51	51	1 : View List ['sign_key_free']	51	73	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:255
47	1193	5 : View List ['mp_exptmod', 'mp_invmod', 'mp_abs', 'mp_clear_multi', 'mp_init_multi']	47	1193	mp_exptmod	call site: 00000	/src/dropbear/libtommath/bn_mp_exptmod.c:21
38	38	1 : View List ['hash_memory']	38	53	hmac_init	call site: 00772	/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c:57
32	32	1 : View List ['check_group_membership']	42	46	checkusername	call site: 00000	/src/dropbear/src/svr-auth.c:294

Runtime coverage analysis

Covered functions

366

Functions that are reachable but not covered

121

Reachable functions

319

Percentage of reachable functions covered

62.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-preauth.c	1
fuzz/fuzz-common.c	11
src/dbutil.c	14
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
fuzz/fuzz-wrapfd.c	8
src/buffer.c	23
src/dbhelpers.c	1
src/ecc.c	4
src/svr-session.c	5
src/common-session.c	14
src/common-channel.c	16
src/circbuffer.c	5
src/netio.c	13
src/listener.c	5
src/list.c	1
src/queue.c	5
libtommath/bn_mp_clear.c	1
src/signkey.c	6
src/dss.c	3
src/bignum.c	2
src/rsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
src/ed25519.c	2
src/svr-runopts.c	4
src/common-runopts.c	3
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/ecdsa.c	3
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/svr-auth.c	1
src/svr-chansession.c	3
src/svr-authpubkeyoptions.c	1
src/packet.c	11
src/common-kex.c	3
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-pubkey

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	37.0%
gold	[1:9]	22	7.61%
yellow	[10:29]	3	1.03%
greenyellow	[30:49]	5	1.73%
lawngreen	50+	152	52.5%
All colors	289	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
62	62	1 : View List ['sign_key_fingerprint']	66	102	cmp_base64_key	call site: 00191	/src/dropbear/src/signkey.c:750
2	2	1 : View List ['exit']	2	2	generic_dropbear_exit	call site: 00000	/src/dropbear/src/dbutil.c:124
0	2	1 : View List ['dropbear_exit']	0	2	buf_new	call site: 00125	/src/dropbear/src/buffer.c:43
0	2	1 : View List ['dropbear_exit']	0	2	buf_setlen	call site: 00180	/src/dropbear/src/buffer.c:96
0	2	1 : View List ['dropbear_exit']	0	2	buf_incrlen	call site: 00135	/src/dropbear/src/buffer.c:105
0	2	1 : View List ['dropbear_exit']	0	2	buf_setpos	call site: 00137	/src/dropbear/src/buffer.c:113
0	2	1 : View List ['dropbear_exit']	0	2	buf_incrwritepos	call site: 00131	/src/dropbear/src/buffer.c:121
0	2	1 : View List ['dropbear_exit']	0	2	buf_incrpos	call site: 00063	/src/dropbear/src/buffer.c:132
0	2	1 : View List ['dropbear_exit']	0	2	buf_decrpos	call site: 00160	/src/dropbear/src/buffer.c:141
0	2	1 : View List ['dropbear_exit']	0	2	buf_getbyte	call site: 00158	/src/dropbear/src/buffer.c:152
0	2	1 : View List ['dropbear_exit']	0	2	buf_getwriteptr	call site: 00129	/src/dropbear/src/buffer.c:192
0	2	1 : View List ['dropbear_exit']	0	2	crypto_init	call site: 00023	/src/dropbear/src/crypto_desc.c:64

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

50

Reachable functions

110

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-pubkey.c	2
fuzz/fuzz-common.c	3
src/dbutil.c	4
src/dbmalloc.c	8
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
fuzz/fuzz-wrapfd.c	5
src/buffer.c	17
src/dbhelpers.c	1
src/ecc.c	1
src/signkey.c	5
src/svr-authpubkey.c	2
libtomcrypt/src/misc/base64/base64_decode.c	2
libtomcrypt/src/misc/base64/base64_encode.c	2
src/svr-authpubkeyoptions.c	3
src/list.c	3
src/common-runopts.c	1

Fuzzer: fuzzer-kexecdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	28.4%
gold	[1:9]	3	0.86%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.57%
lawngreen	50+	244	70.1%
All colors	348	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
156	156	1 : View List ['buf_put_dss_pub_key']	331	429	buf_put_pub_key	call site: 00259	/src/dropbear/src/signkey.c:427
156	156	1 : View List ['buf_put_rsa_pub_key']	175	273	buf_put_pub_key	call site: 00260	/src/dropbear/src/signkey.c:432
69	87	4 : View List ['buf_setpos', 'stat', 'buf_new', 'buf_readfile']	144	184	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:375
21	21	1 : View List ['parse_recv_window']	73	87	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:407
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	dss_key_free	call site: 00000	/src/dropbear/src/dss.c:125
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	rsa_key_free	call site: 00000	/src/dropbear/src/rsa.c:146
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_dss_priv_key	call site: 00000	/src/dropbear/src/dss.c:113
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_rsa_priv_key	call site: 00000	/src/dropbear/src/rsa.c:133
19	19	1 : View List ['buf_put_ed25519_pub_key']	19	49	buf_put_pub_key	call site: 00293	/src/dropbear/src/signkey.c:445
15	27	5 : View List ['getuid', 'strlen', 'm_malloc', 'fuzz_getpwuid', 'getenv']	15	43	expand_homedir_path	call site: 00000	/src/dropbear/src/dbutil.c:640
13	13	1 : View List ['m_str_to_uint']	13	19	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:441
2	2	1 : View List ['getgrnam']	75	91	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:396

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

22

Reachable functions

124

Percentage of reachable functions covered

82.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-kexecdh.c	1
fuzz/fuzz-common.c	1
fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	10
src/buffer.c	21
src/dbutil.c	3
src/common-kex.c	2
src/ecc.c	6
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_mp_cmp_d.c	1
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1

Fuzzer: fuzzer-client_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1340	74.9%
gold	[1:9]	104	5.81%
yellow	[10:29]	3	0.16%
greenyellow	[30:49]	2	0.11%
lawngreen	50+	338	18.9%
All colors	1787	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4532	4642	20 : View List ['buf_getstringbuf', 'kexecdh_comb_key', 'checkhostkey', 'sign_key_free', 'mp_clear', 'free_kexcurve25519_param', 'buf_verify', 'free_kexdh_param', 'buf_getint', 'buf_getptr', 'free_kexecdh_param', 'new_sign_key', 'kexcurve25519_comb_key', 'kexdh_comb_key', 'buf_getmpint', 'buf_get_pub_key', 'dropbear_exit', 'send_msg_newkeys', 'buf_free', 'm_mp_init']	4532	4642	recv_msg_kexdh_reply	call site: 00000	/src/dropbear/src/cli-kex.c:110
1377	1659	11 : View List ['gen_kexecdh_param', 'buf_putstring', 'buf_putmpint', 'gen_kexcurve25519_param', 'buf_putbyte', 'encrypt_packet', 'gen_kexdh_param', 'free_kexcurve25519_param', 'free_kexdh_param', 'buf_put_ecc_raw_pubkey_string', 'free_kexecdh_param']	1377	1659	send_msg_kexdh_init	call site: 00774	/src/dropbear/src/cli-kex.c:51
1315	1315	1 : View List ['recv_msg_userauth_pk_ok']	1315	1315	recv_msg_userauth_specific_60	call site: 00000	/src/dropbear/src/cli-auth.c:130
597	597	3 : View List ['signkey_key_ptr', 'ecc_free', 'buf_get_ecdsa_priv_key']	597	659	buf_get_priv_key	call site: 00363	/src/dropbear/src/signkey.c:385
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	560	564	checktimeouts	call site: 01186	/src/dropbear/src/common-session.c:555
309	309	1 : View List ['recv_msg_userauth_info_request']	309	309	recv_msg_userauth_specific_60	call site: 00000	/src/dropbear/src/cli-auth.c:137
170	216	2 : View List ['dss_key_free', 'buf_get_dss_priv_key']	920	1101	buf_get_priv_key	call site: 00279	/src/dropbear/src/signkey.c:363
153	199	2 : View List ['rsa_key_free', 'buf_get_rsa_priv_key']	750	873	buf_get_priv_key	call site: 00339	/src/dropbear/src/signkey.c:374
103	114	5 : View List ['check_user_algos', 'algolist_string', 'm_free_direct', 'dropbear_log', 'strcmp']	103	118	parse_ciphers_macs	call site: 00624	/src/dropbear/src/common-runopts.c:81
61	61	1 : View List ['cli_pubkeyfail']	67	108	recv_msg_userauth_failure	call site: 00000	/src/dropbear/src/cli-auth.c:190
39	39	1 : View List ['split_address_port']	86	970	cli_getopts	call site: 00637	/src/dropbear/src/cli-runopts.c:437
38	56	3 : View List ['strlen', 'm_realloc', 'multihop_passthrough_args']	38	74	parse_multihop_hostname	call site: 00668	/src/dropbear/src/cli-runopts.c:633

Runtime coverage analysis

Covered functions

197

Functions that are reachable but not covered

313

Reachable functions

471

Percentage of reachable functions covered

33.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-client_nomaths.c	1
fuzz/fuzz-common.c	9
src/dbutil.c	16
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
fuzz/fuzz-wrapfd.c	8
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-session.c	11
src/common-session.c	13
src/common-channel.c	18
src/circbuffer.c	6
src/netio.c	14
src/listener.c	6
src/list.c	3
src/queue.c	5
libtommath/bn_mp_clear.c	1
src/cli-runopts.c	12
src/common-runopts.c	5
src/signkey.c	11
src/dss.c	5
src/bignum.c	4
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/compat.c	2
src/cli-chansession.c	5
src/cli-kex.c	1
src/common-kex.c	10
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/curve25519.c	21
src/packet.c	11
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/atomicio.c	1
src/process-packet.c	2
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-tcpfwd.c	5
src/tcp-accept.c	2

Fuzzer: fuzzer-kexdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	212	48.2%
gold	[1:9]	3	0.68%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.68%
lawngreen	50+	221	50.3%
All colors	439	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
466	1193	5 : View List ['mp_exptmod', 'mp_invmod', 'mp_abs', 'mp_clear_multi', 'mp_init_multi']	466	1193	mp_exptmod	call site: 00097	/src/dropbear/libtommath/bn_mp_exptmod.c:21
156	156	1 : View List ['buf_put_dss_pub_key']	331	429	buf_put_pub_key	call site: 00344	/src/dropbear/src/signkey.c:427
156	156	1 : View List ['buf_put_rsa_pub_key']	175	273	buf_put_pub_key	call site: 00345	/src/dropbear/src/signkey.c:432
69	87	4 : View List ['buf_setpos', 'stat', 'buf_new', 'buf_readfile']	144	184	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:375
21	21	1 : View List ['parse_recv_window']	73	87	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:407
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	dss_key_free	call site: 00000	/src/dropbear/src/dss.c:125
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	rsa_key_free	call site: 00000	/src/dropbear/src/rsa.c:146
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_dss_priv_key	call site: 00000	/src/dropbear/src/dss.c:113
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_rsa_priv_key	call site: 00000	/src/dropbear/src/rsa.c:133
19	19	1 : View List ['buf_put_ed25519_pub_key']	19	49	buf_put_pub_key	call site: 00383	/src/dropbear/src/signkey.c:445
15	27	5 : View List ['getuid', 'strlen', 'm_malloc', 'fuzz_getpwuid', 'getenv']	15	43	expand_homedir_path	call site: 00000	/src/dropbear/src/dbutil.c:640
13	13	1 : View List ['m_str_to_uint']	13	19	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:441

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

31

Reachable functions

134

Percentage of reachable functions covered

76.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-kexdh.c	1
fuzz/fuzz-common.c	1
fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	19
src/dbutil.c	2
src/bignum.c	4
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/common-kex.c	3
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1

Fuzzer: fuzzer-postauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	419	39.2%
gold	[1:9]	183	17.1%
yellow	[10:29]	25	2.34%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	439	41.1%
All colors	1067	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4463	4895	16 : View List ['kexecdh_comb_key', 'encrypt_packet', 'gen_kexdh_param', 'free_kexcurve25519_param', 'free_kexdh_param', 'free_kexecdh_param', 'buf_put_sign', 'gen_kexecdh_param', 'kexcurve25519_comb_key', 'buf_putstring', 'kexdh_comb_key', 'buf_putmpint', 'gen_kexcurve25519_param', 'buf_putbyte', 'buf_put_ecc_raw_pubkey_string', 'buf_put_pub_key']	4463	4895	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:203
3229	3367	12 : View List ['svr_auth_pubkey', 'checkusername', 'buf_getstring', 'svr_auth_password', 'send_msg_userauth_success', 'buf_free', 'm_free_direct', 'dropbear_exit', 'strncmp', 'dropbear_log', 'send_msg_userauth_failure', 'send_msg_userauth_banner']	3229	3367	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:85
1770	1770	1 : View List ['svr_ensure_hostkey']	6233	6726	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:196
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	550	564	checktimeouts	call site: 00879	/src/dropbear/src/common-session.c:555
497	732	24 : View List ['pty_make_controlling_tty', 'dup2', 'login_login', 'fork', 'setnonblocking', 'login_free_entry', 'buf_setpos', 'buf_incrpos', 'signal', 'buf_getptr', 'wrapfd_write', 'buf_readfile', 'stat', 'buf_new', 'strlen', 'm_free_direct', 'expand_homedir_path', 'execchild', 'wrapfd_close', 'addchildpid', 'm_malloc', 'dropbear_exit', 'buf_free', 'chansess_login_alloc']	497	732	ptycommand	call site: 00000	/src/dropbear/src/svr-chansession.c:816
368	368	1 : View List ['svr_agentreq']	368	901	chansessionrequest	call site: 00000	/src/dropbear/src/svr-chansession.c:402
261	261	1 : View List ['send_msg_channel_window_adjust']	261	277	writechannel	call site: 01007	/src/dropbear/src/common-channel.c:523
261	261	1 : View List ['send_msg_request_success']	261	270	recv_msg_global_request_remotetcp	call site: 00000	/src/dropbear/src/svr-tcpfwd.c:114
84	88	6 : View List ['getpeername', '__errno_location', 'getaddrstring', 'dropbear_exit', 'strerror', 'getsockname']	84	88	get_socket_address	call site: 00640	/src/dropbear/src/netio.c:618
73	73	1 : View List ['lastlog_write_entry']	73	73	login_write	call site: 00000	/src/dropbear/src/loginrec.c:327
69	87	4 : View List ['buf_setpos', 'stat', 'buf_new', 'buf_readfile']	144	184	svr_getopts	call site: 00268	/src/dropbear/src/svr-runopts.c:375
64	64	1 : View List ['fd_read_pending']	64	1134	check_close	call site: 01025	/src/dropbear/src/common-channel.c:299

Runtime coverage analysis

Covered functions

343

Functions that are reachable but not covered

108

Reachable functions

319

Percentage of reachable functions covered

66.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-postauth_nomaths.c	1
fuzz/fuzz-common.c	11
src/dbutil.c	14
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
fuzz/fuzz-wrapfd.c	8
src/buffer.c	23
src/dbhelpers.c	1
src/ecc.c	4
src/svr-session.c	5
src/common-session.c	14
src/common-channel.c	16
src/circbuffer.c	5
src/netio.c	13
src/listener.c	5
src/list.c	1
src/queue.c	5
libtommath/bn_mp_clear.c	1
src/signkey.c	6
src/dss.c	3
src/bignum.c	2
src/rsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
src/ed25519.c	2
src/svr-runopts.c	4
src/common-runopts.c	3
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/ecdsa.c	3
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/svr-auth.c	1
src/svr-chansession.c	3
src/svr-authpubkeyoptions.c	1
src/packet.c	11
src/common-kex.c	3
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	848	47.4%
gold	[1:9]	116	6.49%
yellow	[10:29]	10	0.55%
greenyellow	[30:49]	7	0.39%
lawngreen	50+	806	45.1%
All colors	1787	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
572	597	3 : View List ['signkey_key_ptr', 'ecc_free', 'buf_get_ecdsa_priv_key']	572	659	buf_get_priv_key	call site: 00363	/src/dropbear/src/signkey.c:385
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	560	564	checktimeouts	call site: 01186	/src/dropbear/src/common-session.c:555
266	279	2 : View List ['signkey_key_ptr', 'buf_sk_ed25519_verify']	266	281	buf_verify	call site: 00000	/src/dropbear/src/signkey.c:702
242	242	1 : View List ['buf_sk_ecdsa_verify']	508	536	buf_verify	call site: 00000	/src/dropbear/src/signkey.c:694
170	216	2 : View List ['dss_key_free', 'buf_get_dss_priv_key']	895	1101	buf_get_priv_key	call site: 00279	/src/dropbear/src/signkey.c:363
153	199	2 : View List ['rsa_key_free', 'buf_get_rsa_priv_key']	725	873	buf_get_priv_key	call site: 00339	/src/dropbear/src/signkey.c:374
103	114	5 : View List ['check_user_algos', 'algolist_string', 'm_free_direct', 'dropbear_log', 'strcmp']	103	118	parse_ciphers_macs	call site: 00624	/src/dropbear/src/common-runopts.c:81
47	1193	5 : View List ['mp_exptmod', 'mp_invmod', 'mp_abs', 'mp_clear_multi', 'mp_init_multi']	47	1193	mp_exptmod	call site: 00800	/src/dropbear/libtommath/bn_mp_exptmod.c:21
39	39	1 : View List ['split_address_port']	86	970	cli_getopts	call site: 00637	/src/dropbear/src/cli-runopts.c:437
38	56	3 : View List ['strlen', 'm_realloc', 'multihop_passthrough_args']	38	74	parse_multihop_hostname	call site: 00668	/src/dropbear/src/cli-runopts.c:633
36	708	4 : View List ['buf_get_priv_key', 'buf_getptr', 'buf_setpos', 'addrandom']	36	723	readhostkey	call site: 00249	/src/dropbear/src/common-runopts.c:46
21	21	1 : View List ['parse_recv_window']	47	927	cli_getopts	call site: 00648	/src/dropbear/src/cli-runopts.c:460

Runtime coverage analysis

Covered functions

351

Functions that are reachable but not covered

185

Reachable functions

471

Percentage of reachable functions covered

60.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzer-client.c	1
fuzz/fuzz-common.c	9
src/dbutil.c	16
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
fuzz/fuzz-wrapfd.c	8
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-session.c	11
src/common-session.c	13
src/common-channel.c	18
src/circbuffer.c	6
src/netio.c	14
src/listener.c	6
src/list.c	3
src/queue.c	5
libtommath/bn_mp_clear.c	1
src/cli-runopts.c	12
src/common-runopts.c	5
src/signkey.c	11
src/dss.c	5
src/bignum.c	4
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/compat.c	2
src/cli-chansession.c	5
src/cli-kex.c	1
src/common-kex.c	10
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/curve25519.c	21
src/packet.c	11
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/atomicio.c	1
src/process-packet.c	2
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-tcpfwd.c	5
src/tcp-accept.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
chansessionrequest	/src/dropbear/src/svr-chansession.c	1	['struct.Channel.1393 *']	7	0	187	39	12	214	0	841	341
send_msg_kexdh_reply	/src/dropbear/src/svr-kex.c	2	['struct.mp_int *', 'struct.buf *']	7	0	135	17	4	314	1	2022	169
ltc_ecc_projective_add_point	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	5	['struct.ecc_point *', 'struct.ecc_point *', 'struct.ecc_point *', 'char *', 'char *']	2	0	1374	209	86	6	0	163	146
svr_auth_pubkey	/src/dropbear/src/svr-authpubkey.c	1	['int ']	6	0	385	55	19	264	1	1726	76
ltc_ecc_mul2add	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	6	['struct.ecc_point *', 'char *', 'struct.ecc_point *', 'char *', 'struct.ecc_point *', 'char *']	2	0	891	132	42	17	0	103	56
dropbear_chachapoly_crypt	/src/dropbear/src/chachapoly.c	7	['int ', 'char *', 'char *', 'size_t ', 'size_t ', 'struct.dropbear_chachapoly_state *', 'int ']	3	0	187	25	10	13	0	62	52
montgomery_reduce	/src/dropbear/libtomcrypt/src/math/ltm_desc.c	3	['char *', 'char *', 'char *']	5	0	62	15	2	20	0	127	48
mp_reduce	/src/dropbear/libtommath/bn_mp_reduce.c	3	['struct.mp_int *', 'struct.mp_int *', 'struct.mp_int *']	4	0	151	32	14	41	0	319	44
cli_initchansess	/src/dropbear/src/cli-chansession.c	1	['struct.Channel.809 *']	6	0	66	12	5	92	0	336	40
checkhostkey	/src/dropbear/src/cli-kex.c	2	['char *', 'int ']	3	0	309	43	16	58	1	216	38

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

593/782

Cyclomatic complexity statically reachable by fuzzers

4051 / 4977

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ctr_encrypt	38	14	36.84%	[]
ctr_start	44	22	50.0%	[]
checktimeouts	34	15	44.11%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
set_sock_priority	40	8	20.0%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
write_packet	33	18	54.54%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
signkey_key_ptr	38	16	42.10%	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
svr_auth_password	65	31	47.69%	[]
svr_auth_pubkey	107	53	49.53%	[]
svr_chansess_checksignal	35	6	17.14%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
svr_getopts	269	82	30.48%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
mp_exptmod	41	18	43.90%	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
mp_montgomery_reduce	45	10	22.22%	[]
mp_prime_is_prime	128	59	46.09%	['fuzzer-verify']
mp_reduce	52	26	50.0%	[]
mp_sqrt	44	23	52.27%	['fuzzer-verify']
s_mp_mul_digs	38	11	28.94%	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
s_mp_mul_high_digs	37	12	32.43%	[]
buf_ecdsa_verify	98	53	54.08%	['fuzzer-verify']
cli_getopts	319	141	44.20%	['fuzzer-client_nomaths', 'fuzzer-client']
parse_multihop_hostname	44	18	40.90%	['fuzzer-client_nomaths', 'fuzzer-client']
cli_sessionloop	91	33	36.26%	['fuzzer-client_nomaths', 'fuzzer-client']
spawn_command	68	11	16.17%	[]
connect_remote	40	18	45.0%	[]
dropbear_listen	111	14	12.61%	['fuzzer-client_nomaths', 'fuzzer-client']
pty_setowner	46	14	30.43%	[]
svr_agentcleanup	34	8	23.52%	[]
ptycommand	77	14	18.18%	[]
get_termmodes	67	14	20.89%	[]

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/dropbear/libtommath/bn_mp_init_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_setup.c	[]	[]
/src/dropbear/src/common-session.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_cipher.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/fuzz/fuzzer-pubkey.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_points.c	['fuzzer-verify', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mul.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_decrypt.c	[]	[]
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_start.c	[]	[]
/src/dropbear/src/crypto_desc.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/zeromem.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_clamp.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_gcd.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_dr_setup.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	[]
/src/dropbear/src/dbutil.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/buffer.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cmp.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/circbuffer.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_s_mp_montgomery_reduce_fast.c	[]	[]
/src/dropbear/src/cli-runopts.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_add.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/svr-runopts.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/bignum.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/ecc.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/signkey.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs.c	[]	[]
/src/dropbear/src/svr-authpubkey.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/src/svr-agentfwd.c	[]	[]
/src/dropbear/fuzz/fuzzer-client.c	['fuzzer-client']	['fuzzer-client']
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_done.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha256.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/dss.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_dr_reduce.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_sqr.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_set_ul.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/src/cli-agentfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_argchk.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	[]	[]
/src/dropbear/libtommath/bn_mp_read_radix.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sqrmod.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_reduce_is_2k.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_zero.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_cipher.c	[]	[]
/src/dropbear/libtomcrypt/src/math/multi.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/src/packet.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/svr-session.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/hashes/helper/hash_memory.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/fuzz/fuzzer-preauth_nomaths.c	['fuzzer-preauth_nomaths']	['fuzzer-preauth_nomaths']
/src/dropbear/src/compat.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/mac/poly1305/poly1305.c	[]	[]
/src/dropbear/libtommath/bn_mp_mul_2d.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_reverse.c	[]	[]
/src/dropbear/fuzz/fuzz-sshpacketmutator.c	[]	[]
/src/dropbear/libtommath/bn_mp_get_l.c	[]	[]
/src/dropbear/src/svr-authpubkeyoptions.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/misc/base64/base64_decode.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/src/common-runopts.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/common-channel.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/fuzz/fuzzer-verify.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_exptmod.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cnt_lsb.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/fuzz/fuzzer-preauth.c	['fuzzer-preauth']	['fuzzer-preauth']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_make_key.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/src/cli-chansession.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/fuzz/fuzzer-kexecdh.c	['fuzzer-kexecdh']	['fuzzer-kexecdh']
/src/dropbear/libtomcrypt/src/headers/tomcrypt_macros.h	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/tcp-accept.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mulmod_timing.c	[]	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_crypt.c	[]	[]
/src/dropbear/libtommath/bn_mp_neg.c	[]	[]
/src/dropbear/libtommath/bn_mp_div_2.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/dbhelpers.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_montgomery_setup.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_get_mag_ul.c	[]	[]
/src/dropbear/libtommath/bn_mp_cmp_d.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/common-algo.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs_fast.c	[]	[]
/src/dropbear/libtommath/bn_mp_sub_d.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mulmod.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_multi.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sub.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_digs.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div_3.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/fuzz/fuzzer-postauth_nomaths.c	['fuzzer-postauth_nomaths']	['fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_prime_rabin_miller_trials.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_to_ubin.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/svr-service.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_cipher_is_valid.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_add.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_l.c	[]	[]
/src/dropbear/src/curve25519.c	['fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/queue.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/dbrandom.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_map.c	[]	[]
/src/dropbear/libtommath/bn_mp_montgomery_calc_normalization.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/ltc_prng.c	[]	[]
/src/dropbear/src/svr-authpasswd.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_prng.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_grow.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_set_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_abs.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_copy.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_exptmod_fast.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/ecdsa.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/rsa.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_invmod_slow.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_sub.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_setup.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_mul_2.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/svr-kex.c	[]	[]
/src/dropbear/libtommath/bn_mp_set.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_hash.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sqr.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_balance_mul.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/svr-auth.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_clear.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_invmod_fast.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha384.c	[]	[]
/src/dropbear/src/atomicio.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/svr-tcpfwd.c	[]	[]
/src/dropbear/src/gened25519.c	[]	[]
/src/dropbear/src/sshpty.c	[]	[]
/src/dropbear/libtommath/bn_mp_is_square.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/dbmalloc.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_rand.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_submod.c	[]	[]
/src/dropbear/libtomcrypt/src/hashes/sha1.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/list.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_keystream.c	[]	[]
/src/dropbear/libtommath/bn_mp_add_d.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_to_radix.c	[]	[]
/src/dropbear/libtommath/bn_mp_init_set.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/process-packet.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/chachapoly.c	[]	[]
/src/dropbear/libtommath/bn_mp_reduce_2k_setup_l.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_digs_fast.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce.c	[]	[]
/src/dropbear/libtommath/bn_mp_mul_d.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_exptmod.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_addmod.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_s_mp_prime_is_divisible.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_2expt.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_ubin_size.c	['fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/fuzz/fuzzer-kexdh.c	['fuzzer-kexdh']	['fuzzer-kexdh']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_free.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/src/listener.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/math/ltm_desc.c	[]	[]
/src/dropbear/src/cli-authpasswd.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_invmod.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_dr_is_modulus.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/cli-kex.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_dbl_point.c	[]	[]
/src/dropbear/src/cli-authinteract.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_count_bits.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_rshd.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_sqr_fast.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/fuzz/fuzz-common.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_prime_is_prime.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_montgomery_reduce.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_hash.c	[]	[]
/src/dropbear/fuzz/fuzz-wrapfd.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-pubkey', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_clear_multi.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_size.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mod_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_prime_next_prime.c	[]	[]
/src/dropbear/libtommath/bn_mp_mod.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/ciphers/aes/aes.c	[]	[]
/src/dropbear/libtommath/bn_mp_reduce_setup.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_process.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/sk-ecdsa.c	['fuzzer-verify']	[]
/src/dropbear/src/ed25519.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_lshd.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/common-kex.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-auth.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/sk-ed25519.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/cli-tcpfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_ivctr64.c	[]	[]
/src/dropbear/fuzz/fuzzer-kexcurve25519.c	['fuzzer-kexcurve25519']	['fuzzer-kexcurve25519']
/src/dropbear/src/netio.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/loginrec.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/base64/base64_encode.c	['fuzzer-pubkey']	[]
/src/dropbear/src/gensignkey.c	[]	[]
/src/dropbear/src/svr-chansession.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_sqrt.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_cmp_mag.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-session.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/gendss.c	[]	[]
/src/dropbear/libtommath/bn_mp_lcm.c	[]	[]
/src/dropbear/libtommath/bn_mp_reduce_2k.c	[]	[]
/src/dropbear/src/genrsa.c	[]	[]
/src/dropbear/libtommath/bn_mp_get_mag_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_get_i32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_div_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_mod_2d.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha512.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_copy.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_exch.c	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-channel.c	[]	[]
/src/dropbear/src/cli-authpubkey.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtommath/bn_mp_reduce_is_2k_l.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/fuzz/fuzzer-client_nomaths.c	['fuzzer-client_nomaths']	['fuzzer-client_nomaths']
/src/dropbear/libtommath/bn_mp_prime_miller_rabin.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_encrypt.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/libtommath/bn_mp_from_ubin.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div_2d.c	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client']

Directories in report

Directory
/src/dropbear/libtomcrypt/src/stream/chacha/
/src/dropbear/src/
/src/dropbear/libtomcrypt/src/headers/
/src/dropbear/libtomcrypt/src/misc/
/src/dropbear/fuzz/
/src/dropbear/libtomcrypt/src/mac/hmac/
/src/dropbear/libtomcrypt/src/hashes/helper/
/src/dropbear/libtomcrypt/src/mac/poly1305/
/src/dropbear/libtomcrypt/src/hashes/
/src/dropbear/libtomcrypt/src/pk/ecc/
/src/dropbear/libtomcrypt/src/modes/ctr/
/src/dropbear/libtommath/
/src/dropbear/libtomcrypt/src/ciphers/aes/
/src/dropbear/libtomcrypt/src/hashes/sha2/
/src/dropbear/libtomcrypt/src/math/
/src/dropbear/libtomcrypt/src/misc/base64/
/src/dropbear/libtomcrypt/src/misc/crypt/

This section shows a chosen list of functions / methods calls and their relative coverage information. By static analysis of the target project code, all of these function call and their caller information, including the source file or class and line number that initiate the call are captured. Column 1 is the function name of that selected functions or methods. Column 2 of each row indicate if the target function covered by any fuzzer calltree information. Column 3 lists all fuzzers (or no fuzzers at all) that have coered that particular function call dynamically. Column 4 shows list of parent function for the specific function call, while column 5 shows possible blocker functions that make the fuzzers fail to reach the specific functions. Both column 4 and 5 will only show information if none of the fuzzers cover the target function calls.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Function call path	Covered by fuzzer	Possible branch blockers
execv	Not in fuzzer provided call tree	[]	Parent functions Callpaths run_shell_command in /src/dropbear/src/dbutil.c:407 Path 1	0	Blocker function Arguments type Return type Constants touched ptycommand in /src/dropbear/src/svr-chansession.c:802 ['struct.Channel.1393 *', 'struct.ChanSess *'] int []