Fuzz introspector: fuzzer-kexcurve25519
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
156 156 1 :

['buf_put_dss_pub_key']

364 429 buf_put_pub_key call site: 00126 /src/dropbear/src/signkey.c:427
156 156 1 :

['buf_put_rsa_pub_key']

208 273 buf_put_pub_key call site: 00127 /src/dropbear/src/signkey.c:432
69 87 4 :

['buf_setpos', 'buf_new', 'buf_readfile', 'stat']

144 184 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:375
52 65 2 :

['signkey_key_ptr', 'buf_put_ecdsa_pub_key']

52 114 buf_put_pub_key call site: 00171 /src/dropbear/src/signkey.c:437
21 21 1 :

['parse_recv_window']

73 87 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:407
20 29 2 :

['m_mp_free_multi', 'm_free_direct']

20 29 dss_key_free call site: 00000 /src/dropbear/src/dss.c:125
20 29 2 :

['m_mp_free_multi', 'm_free_direct']

20 29 rsa_key_free call site: 00000 /src/dropbear/src/rsa.c:146
20 20 1 :

['m_mp_free_multi']

20 20 buf_get_dss_priv_key call site: 00000 /src/dropbear/src/dss.c:113
20 20 1 :

['m_mp_free_multi']

20 20 buf_get_rsa_priv_key call site: 00000 /src/dropbear/src/rsa.c:133
15 27 5 :

['m_malloc', 'fuzz_getpwuid', 'getuid', 'strlen', 'getenv']

15 43 expand_homedir_path call site: 00000 /src/dropbear/src/dbutil.c:640
13 13 1 :

['m_str_to_uint']

13 19 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:441
12 21 2 :

['m_free_direct', 'ecc_free']

12 21 buf_get_ecc_raw_pubkey call site: 00000 /src/dropbear/src/ecc.c:201

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fuzz_set_input [function] [call site] 00001
2 wrapfd_setup [function] [call site] 00002
3 wrapfd_remove [function] [call site] 00003
4 __assert_fail [call site] 00004
4 __assert_fail [call site] 00005
4 __assert_fail [call site] 00006
4 close [call site] 00007
3 wrapfd_setseed [function] [call site] 00008
4 nrand48 [call site] 00009
2 fuzz_seed [function] [call site] 00010
3 sha256_init [function] [call site] 00011
4 crypt_argchk [function] [call site] 00012
5 fprintf [call site] 00013
5 abort [call site] 00014
3 sha256_process [function] [call site] 00015
4 crypt_argchk [function] [call site] 00016
4 sha256_compress [function] [call site] 00017
3 sha256_process [function] [call site] 00018
3 sha256_done [function] [call site] 00019
4 crypt_argchk [function] [call site] 00020
4 crypt_argchk [function] [call site] 00021
4 sha256_compress [function] [call site] 00022
4 sha256_compress [function] [call site] 00023
1 m_malloc_set_epoch [function] [call site] 00024
1 _setjmp [call site] 00025
1 buf_getint [function] [call site] 00026
2 buf_getptr [function] [call site] 00027
3 dropbear_exit [function] [call site] 00028
2 buf_incrpos [function] [call site] 00029
3 dropbear_exit [function] [call site] 00030
1 buf_getstringbuf [function] [call site] 00031
2 buf_getstringbuf_int [function] [call site] 00032
3 buf_getint [function] [call site] 00033
3 dropbear_exit [function] [call site] 00034
3 buf_new [function] [call site] 00035
4 dropbear_exit [function] [call site] 00036
4 m_malloc [function] [call site] 00037
5 dropbear_exit [function] [call site] 00038
5 calloc [call site] 00039
5 dropbear_exit [function] [call site] 00040
5 put_alloc [function] [call site] 00041
6 __assert_fail [call site] 00042
6 __assert_fail [call site] 00043
3 buf_putint [function] [call site] 00044
4 buf_getwriteptr [function] [call site] 00045
5 dropbear_exit [function] [call site] 00046
4 buf_incrwritepos [function] [call site] 00047
5 dropbear_exit [function] [call site] 00048
3 buf_getwriteptr [function] [call site] 00049
3 buf_incrpos [function] [call site] 00050
3 buf_incrlen [function] [call site] 00051
4 dropbear_exit [function] [call site] 00052
3 buf_setpos [function] [call site] 00053
4 dropbear_exit [function] [call site] 00054
1 kexcurve25519_comb_key [function] [call site] 00056
2 dropbear_exit [function] [call site] 00057
2 constant_time_memcmp [function] [call site] 00094
2 dropbear_exit [function] [call site] 00095
2 m_mp_alloc_init_multi [function] [call site] 00096
3 dropbear_exit [function] [call site] 00102
2 bytes_to_mp [function] [call site] 00103
3 mp_from_ubin [function] [call site] 00104
3 dropbear_exit [function] [call site] 00122
2 m_burn [function] [call site] 00123
3 explicit_bzero [call site] 00124
2 buf_put_pub_key [function] [call site] 00125
3 buf_put_dss_pub_key [function] [call site] 00127
4 fail_assert [function] [call site] 00128
5 dropbear_exit [function] [call site] 00129
4 buf_putstring [function] [call site] 00130
5 buf_putint [function] [call site] 00131
5 buf_putbytes [function] [call site] 00132
6 buf_getwriteptr [function] [call site] 00133
6 buf_incrwritepos [function] [call site] 00134
4 buf_putmpint [function] [call site] 00135
5 fail_assert [function] [call site] 00136
5 dropbear_exit [function] [call site] 00137
5 mp_count_bits [function] [call site] 00138
5 buf_putint [function] [call site] 00139
5 buf_putbyte [function] [call site] 00140
6 buf_incrlen [function] [call site] 00141
5 buf_getwriteptr [function] [call site] 00142
5 dropbear_exit [function] [call site] 00162
5 buf_incrwritepos [function] [call site] 00163
4 buf_putmpint [function] [call site] 00164
4 buf_putmpint [function] [call site] 00165
4 buf_putmpint [function] [call site] 00166
3 buf_put_rsa_pub_key [function] [call site] 00167
4 buf_putstring [function] [call site] 00168
4 buf_putmpint [function] [call site] 00169
4 buf_putmpint [function] [call site] 00170
3 signkey_is_ecdsa [function] [call site] 00171
3 signkey_key_ptr [function] [call site] 00172
3 buf_put_ecdsa_pub_key [function] [call site] 00173
4 curve_for_dp [function] [call site] 00174
5 __assert_fail [call site] 00175
4 snprintf [call site] 00176
4 strlen [call site] 00177
4 buf_putstring [function] [call site] 00178
4 strlen [call site] 00179
4 buf_putstring [function] [call site] 00180
4 buf_put_ecc_raw_pubkey_string [function] [call site] 00181
5 buf_putint [function] [call site] 00182
5 buf_getwriteptr [function] [call site] 00183
5 ecc_ansi_x963_export [function] [call site] 00184
6 crypt_argchk [function] [call site] 00185
6 crypt_argchk [function] [call site] 00186
6 ltc_ecc_is_valid_idx [function] [call site] 00187
6 crypt_argchk [function] [call site] 00188
5 dropbear_exit [function] [call site] 00192
5 buf_incrwritepos [function] [call site] 00193
3 buf_put_ed25519_pub_key [function] [call site] 00194
4 fail_assert [function] [call site] 00195
4 buf_putstring [function] [call site] 00196
4 buf_putstring [function] [call site] 00197
3 dropbear_exit [function] [call site] 00198
3 buf_putbufstring [function] [call site] 00199
4 buf_putstring [function] [call site] 00200
3 buf_free [function] [call site] 00201
4 m_free_direct [function] [call site] 00202
5 get_header [function] [call site] 00203
5 remove_alloc [function] [call site] 00204
2 buf_putstring [function] [call site] 00205
2 buf_putstring [function] [call site] 00206
2 buf_putmpint [function] [call site] 00207
2 finish_kexhashbuf [function] [call site] 00208
3 buf_setpos [function] [call site] 00209
3 buf_getptr [function] [call site] 00210
3 buf_getwriteptr [function] [call site] 00212
3 buf_setlen [function] [call site] 00213
4 dropbear_exit [function] [call site] 00214
3 buf_burn_free [function] [call site] 00215
4 m_free_direct [function] [call site] 00217
1 m_free_direct [function] [call site] 00222
1 m_malloc_free_epoch [function] [call site] 00226
2 put_alloc [function] [call site] 00227