Fuzz introspector: fuzzer-kexdh
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
466 1193 5 :

['mp_invmod', 'mp_exptmod', 'mp_clear_multi', 'mp_init_multi', 'mp_abs']

466 1193 mp_exptmod call site: 00097 /src/dropbear/libtommath/bn_mp_exptmod.c:21
156 156 1 :

['buf_put_dss_pub_key']

331 429 buf_put_pub_key call site: 00344 /src/dropbear/src/signkey.c:427
156 156 1 :

['buf_put_rsa_pub_key']

175 273 buf_put_pub_key call site: 00345 /src/dropbear/src/signkey.c:432
69 87 4 :

['buf_setpos', 'buf_new', 'buf_readfile', 'stat']

144 184 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:375
21 21 1 :

['parse_recv_window']

73 87 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:407
20 29 2 :

['m_mp_free_multi', 'm_free_direct']

20 29 dss_key_free call site: 00000 /src/dropbear/src/dss.c:125
20 29 2 :

['m_mp_free_multi', 'm_free_direct']

20 29 rsa_key_free call site: 00000 /src/dropbear/src/rsa.c:146
20 20 1 :

['m_mp_free_multi']

20 20 buf_get_dss_priv_key call site: 00000 /src/dropbear/src/dss.c:113
20 20 1 :

['m_mp_free_multi']

20 20 buf_get_rsa_priv_key call site: 00000 /src/dropbear/src/rsa.c:133
19 19 1 :

['buf_put_ed25519_pub_key']

19 49 buf_put_pub_key call site: 00383 /src/dropbear/src/signkey.c:445
15 27 5 :

['m_malloc', 'fuzz_getpwuid', 'getuid', 'strlen', 'getenv']

15 43 expand_homedir_path call site: 00000 /src/dropbear/src/dbutil.c:640
13 13 1 :

['m_str_to_uint']

13 19 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:441

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fuzz_set_input [function] [call site] 00001
2 wrapfd_setup [function] [call site] 00002
3 wrapfd_remove [function] [call site] 00003
4 __assert_fail [call site] 00004
4 __assert_fail [call site] 00005
4 __assert_fail [call site] 00006
4 close [call site] 00007
3 wrapfd_setseed [function] [call site] 00008
4 nrand48 [call site] 00009
2 fuzz_seed [function] [call site] 00010
3 sha256_init [function] [call site] 00011
4 crypt_argchk [function] [call site] 00012
5 fprintf [call site] 00013
5 abort [call site] 00014
3 sha256_process [function] [call site] 00015
4 crypt_argchk [function] [call site] 00016
4 sha256_compress [function] [call site] 00017
3 sha256_process [function] [call site] 00018
3 sha256_done [function] [call site] 00019
4 crypt_argchk [function] [call site] 00020
4 crypt_argchk [function] [call site] 00021
4 sha256_compress [function] [call site] 00022
4 sha256_compress [function] [call site] 00023
1 m_malloc_set_epoch [function] [call site] 00024
1 _setjmp [call site] 00025
1 buf_getint [function] [call site] 00026
2 buf_getptr [function] [call site] 00027
3 dropbear_exit [function] [call site] 00028
2 buf_incrpos [function] [call site] 00029
3 dropbear_exit [function] [call site] 00030
1 m_mp_init [function] [call site] 00031
2 mp_init [function] [call site] 00032
3 m_calloc [function] [call site] 00033
4 dropbear_exit [function] [call site] 00034
4 m_malloc [function] [call site] 00035
5 dropbear_exit [function] [call site] 00036
5 calloc [call site] 00037
5 dropbear_exit [function] [call site] 00038
5 put_alloc [function] [call site] 00039
6 __assert_fail [call site] 00040
6 __assert_fail [call site] 00041
2 dropbear_exit [function] [call site] 00042
1 buf_getmpint [function] [call site] 00043
2 buf_getint [function] [call site] 00044
2 mp_zero [function] [call site] 00045
2 buf_getptr [function] [call site] 00046
2 buf_getptr [function] [call site] 00047
2 mp_from_ubin [function] [call site] 00048
3 mp_grow [function] [call site] 00049
4 m_realloc_ltm [function] [call site] 00050
5 m_realloc [function] [call site] 00051
6 dropbear_exit [function] [call site] 00052
6 get_header [function] [call site] 00053
6 remove_alloc [function] [call site] 00054
6 realloc [call site] 00055
6 dropbear_exit [function] [call site] 00056
6 put_alloc [function] [call site] 00057
3 mp_zero [function] [call site] 00058
3 mp_mul_2d [function] [call site] 00059
4 mp_copy [function] [call site] 00060
5 mp_grow [function] [call site] 00061
4 mp_lshd [function] [call site] 00062
5 mp_grow [function] [call site] 00063
4 mp_clamp [function] [call site] 00064
3 mp_clamp [function] [call site] 00065
2 buf_incrpos [function] [call site] 00066
1 dropbear_exit [function] [call site] 00067
1 buf_new [function] [call site] 00068
2 dropbear_exit [function] [call site] 00069
2 m_malloc [function] [call site] 00070
1 kexdh_comb_key [function] [call site] 00071
2 m_mp_init_multi [function] [call site] 00072
3 mp_init [function] [call site] 00073
3 dropbear_exit [function] [call site] 00074
2 load_dh_p [function] [call site] 00075
3 bytes_to_mp [function] [call site] 00076
4 mp_from_ubin [function] [call site] 00077
4 dropbear_exit [function] [call site] 00078
2 mp_sub_d [function] [call site] 00079
3 mp_grow [function] [call site] 00080
3 mp_add_d [function] [call site] 00081
4 mp_sub_d [function] [call site] 00082
5 mp_clamp [function] [call site] 00083
5 mp_clamp [function] [call site] 00084
4 mp_clamp [function] [call site] 00085
4 mp_clamp [function] [call site] 00086
2 dropbear_exit [function] [call site] 00087
2 mp_cmp [function] [call site] 00088
3 mp_cmp_mag [function] [call site] 00089
3 mp_cmp_mag [function] [call site] 00090
2 mp_cmp_d [function] [call site] 00091
2 dropbear_exit [function] [call site] 00092
2 m_mp_alloc_init_multi [function] [call site] 00093
3 m_malloc [function] [call site] 00094
3 mp_init [function] [call site] 00095
3 dropbear_exit [function] [call site] 00096
2 mp_exptmod [function] [call site] 00097
3 mp_init_multi [function] [call site] 00098
4 mp_init [function] [call site] 00099
4 mp_clear [function] [call site] 00100
5 m_free_ltm [function] [call site] 00101
6 m_free_direct [function] [call site] 00102
7 get_header [function] [call site] 00103
7 remove_alloc [function] [call site] 00104
3 mp_invmod [function] [call site] 00105
4 mp_cmp_d [function] [call site] 00106
4 s_mp_invmod_fast [function] [call site] 00107
5 mp_init_multi [function] [call site] 00108
5 mp_copy [function] [call site] 00109
5 mp_mod [function] [call site] 00110
6 mp_init_size [function] [call site] 00111
6 mp_div [function] [call site] 00112
7 mp_cmp_mag [function] [call site] 00113
7 mp_copy [function] [call site] 00114
7 mp_zero [function] [call site] 00115
7 mp_init_size [function] [call site] 00116
7 mp_init [function] [call site] 00117
7 mp_init [function] [call site] 00118
7 mp_init_copy [function] [call site] 00119
8 mp_init_size [function] [call site] 00120
8 mp_copy [function] [call site] 00121
8 mp_clear [function] [call site] 00122
7 mp_init_copy [function] [call site] 00123
7 mp_count_bits [function] [call site] 00124
7 mp_mul_2d [function] [call site] 00125
7 mp_mul_2d [function] [call site] 00126
7 mp_lshd [function] [call site] 00127
7 mp_cmp [function] [call site] 00128
7 mp_sub [function] [call site] 00129
8 s_mp_add [function] [call site] 00130
9 mp_grow [function] [call site] 00131
9 mp_clamp [function] [call site] 00132
8 mp_cmp_mag [function] [call site] 00133
8 s_mp_sub [function] [call site] 00134
9 mp_grow [function] [call site] 00135
9 mp_clamp [function] [call site] 00136
8 s_mp_sub [function] [call site] 00137
7 mp_rshd [function] [call site] 00138
7 mp_zero [function] [call site] 00139
7 mp_mul_d [function] [call site] 00140
8 mp_grow [function] [call site] 00141
8 mp_clamp [function] [call site] 00142
7 mp_cmp_mag [function] [call site] 00143
7 mp_mul_d [function] [call site] 00144
7 mp_lshd [function] [call site] 00145
7 mp_sub [function] [call site] 00146
7 mp_copy [function] [call site] 00147
7 mp_lshd [function] [call site] 00148
7 mp_add [function] [call site] 00149
8 s_mp_add [function] [call site] 00150
8 mp_cmp_mag [function] [call site] 00151
8 s_mp_sub [function] [call site] 00152
8 s_mp_sub [function] [call site] 00153
7 mp_clamp [function] [call site] 00154
7 mp_exch [function] [call site] 00155
7 mp_div_2d [function] [call site] 00156
8 mp_zero [function] [call site] 00157
8 mp_copy [function] [call site] 00158
8 mp_mod_2d [function] [call site] 00159
9 mp_zero [function] [call site] 00160
9 mp_copy [function] [call site] 00161
9 mp_copy [function] [call site] 00162
9 mp_clamp [function] [call site] 00163
8 mp_rshd [function] [call site] 00164
8 mp_clamp [function] [call site] 00165
7 mp_exch [function] [call site] 00166
7 mp_clear [function] [call site] 00167
7 mp_clear [function] [call site] 00168
7 mp_clear [function] [call site] 00169
7 mp_clear [function] [call site] 00170
7 mp_clear [function] [call site] 00171
6 mp_exch [function] [call site] 00172
6 mp_add [function] [call site] 00173
6 mp_clear [function] [call site] 00174
5 mp_copy [function] [call site] 00175
5 mp_copy [function] [call site] 00176
5 mp_set [function] [call site] 00177
5 mp_div_2 [function] [call site] 00178
6 mp_clamp [function] [call site] 00179
5 mp_sub [function] [call site] 00180
5 mp_div_2 [function] [call site] 00181
5 mp_div_2 [function] [call site] 00182
5 mp_sub [function] [call site] 00183
5 mp_div_2 [function] [call site] 00184
5 mp_cmp [function] [call site] 00185
5 mp_sub [function] [call site] 00186
5 mp_sub [function] [call site] 00187
5 mp_sub [function] [call site] 00188
5 mp_sub [function] [call site] 00189
5 mp_cmp_d [function] [call site] 00190
5 mp_add [function] [call site] 00191
5 mp_cmp_mag [function] [call site] 00192
5 mp_sub [function] [call site] 00193
5 mp_exch [function] [call site] 00194
5 mp_clear_multi [function] [call site] 00195
6 mp_clear [function] [call site] 00196
4 s_mp_invmod_slow [function] [call site] 00197
5 mp_init_multi [function] [call site] 00198
5 mp_mod [function] [call site] 00199
5 mp_copy [function] [call site] 00200
5 mp_copy [function] [call site] 00201
5 mp_copy [function] [call site] 00202
5 mp_set [function] [call site] 00203
5 mp_set [function] [call site] 00204
5 mp_div_2 [function] [call site] 00205
5 mp_add [function] [call site] 00206
5 mp_sub [function] [call site] 00207
5 mp_div_2 [function] [call site] 00208
5 mp_div_2 [function] [call site] 00209
5 mp_div_2 [function] [call site] 00210
5 mp_add [function] [call site] 00211
5 mp_sub [function] [call site] 00212
5 mp_div_2 [function] [call site] 00213
5 mp_div_2 [function] [call site] 00214
5 mp_cmp [function] [call site] 00215
5 mp_sub [function] [call site] 00216
5 mp_sub [function] [call site] 00217
5 mp_sub [function] [call site] 00218
5 mp_sub [function] [call site] 00219
5 mp_sub [function] [call site] 00220
5 mp_sub [function] [call site] 00221
5 mp_cmp_d [function] [call site] 00222
5 mp_cmp_d [function] [call site] 00223
5 mp_add [function] [call site] 00224
5 mp_cmp_mag [function] [call site] 00225
5 mp_sub [function] [call site] 00226
5 mp_exch [function] [call site] 00227
5 mp_clear_multi [function] [call site] 00228
3 mp_abs [function] [call site] 00229
4 mp_copy [function] [call site] 00230
3 mp_exptmod [function] [call site] 00231
4 mp_clear_multi [function] [call site] 00232
4 mp_reduce_is_2k_l [function] [call site] 00233
4 s_mp_exptmod [function] [call site] 00234
5 mp_count_bits [function] [call site] 00235
5 mp_init [function] [call site] 00236
5 mp_init [function] [call site] 00237
5 mp_clear [function] [call site] 00238
5 mp_clear [function] [call site] 00239
5 mp_init [function] [call site] 00240
5 mp_reduce_setup [function] [call site] 00241
6 mp_2expt [function] [call site] 00242
7 mp_zero [function] [call site] 00243
7 mp_grow [function] [call site] 00244
6 mp_div [function] [call site] 00245
5 mp_reduce_2k_setup_l [function] [call site] 00246
6 mp_init [function] [call site] 00247
6 mp_count_bits [function] [call site] 00248
6 mp_2expt [function] [call site] 00249
6 s_mp_sub [function] [call site] 00250
6 mp_clear [function] [call site] 00251
5 mp_mod [function] [call site] 00252
5 mp_copy [function] [call site] 00253
5 mp_sqr [function] [call site] 00254
6 s_mp_sqr_fast [function] [call site] 00255
7 mp_grow [function] [call site] 00256
7 mp_clamp [function] [call site] 00257
6 s_mp_sqr [function] [call site] 00258
7 mp_init_size [function] [call site] 00259
7 mp_clamp [function] [call site] 00260
7 mp_exch [function] [call site] 00261
7 mp_clear [function] [call site] 00262
5 mp_mul [function] [call site] 00263
6 s_mp_balance_mul [function] [call site] 00264
7 mp_init_size [function] [call site] 00265
7 mp_init_multi [function] [call site] 00266
7 mp_clear [function] [call site] 00267
7 mp_lshd [function] [call site] 00268
7 mp_add [function] [call site] 00269
7 mp_clamp [function] [call site] 00270
7 mp_mul [function] [call site] 00271
8 s_mp_mul_digs_fast [function] [call site] 00272
9 mp_grow [function] [call site] 00273
9 mp_clamp [function] [call site] 00274
8 s_mp_mul_digs [function] [call site] 00275
9 s_mp_mul_digs_fast [function] [call site] 00276
9 mp_init_size [function] [call site] 00277
9 mp_exch [function] [call site] 00278
9 mp_clear [function] [call site] 00279
7 mp_mul [function] [call site] 00280
7 mp_lshd [function] [call site] 00281
7 mp_add [function] [call site] 00282
7 mp_exch [function] [call site] 00283
7 mp_clear_multi [function] [call site] 00284
5 mp_init [function] [call site] 00285
5 mp_set [function] [call site] 00286
5 mp_sqr [function] [call site] 00287
5 mp_sqr [function] [call site] 00288
5 mp_mul [function] [call site] 00289
5 mp_sqr [function] [call site] 00290
5 mp_mul [function] [call site] 00291
5 mp_exch [function] [call site] 00292
5 mp_clear [function] [call site] 00293
5 mp_clear [function] [call site] 00294
5 mp_clear [function] [call site] 00295
5 mp_clear [function] [call site] 00296
4 mp_dr_is_modulus [function] [call site] 00297
4 mp_reduce_is_2k [function] [call site] 00298
5 mp_count_bits [function] [call site] 00299
4 s_mp_exptmod_fast [function] [call site] 00300
5 mp_count_bits [function] [call site] 00301
5 mp_init_size [function] [call site] 00302
5 mp_init_size [function] [call site] 00303
5 mp_clear [function] [call site] 00304
5 mp_clear [function] [call site] 00305
5 mp_montgomery_setup [function] [call site] 00306
5 mp_dr_setup [function] [call site] 00307
5 mp_reduce_2k_setup [function] [call site] 00308
6 mp_init [function] [call site] 00309
6 mp_2expt [function] [call site] 00310
6 s_mp_sub [function] [call site] 00311
6 mp_clear [function] [call site] 00312
5 mp_init_size [function] [call site] 00313
5 mp_montgomery_calc_normalization [function] [call site] 00314
6 mp_count_bits [function] [call site] 00315
6 mp_2expt [function] [call site] 00316
6 mp_set [function] [call site] 00317
6 mp_mul_2 [function] [call site] 00318
7 mp_grow [function] [call site] 00319
6 mp_cmp_mag [function] [call site] 00320
6 s_mp_sub [function] [call site] 00321
5 mp_mulmod [function] [call site] 00322
6 mp_mul [function] [call site] 00323
6 mp_mod [function] [call site] 00324
6 mp_clear [function] [call site] 00325
5 mp_set [function] [call site] 00326
5 mp_mod [function] [call site] 00327
5 mp_copy [function] [call site] 00328
5 mp_sqr [function] [call site] 00329
5 mp_mul [function] [call site] 00330
5 mp_sqr [function] [call site] 00331
5 mp_sqr [function] [call site] 00332
5 mp_mul [function] [call site] 00333
5 mp_sqr [function] [call site] 00334
5 mp_mul [function] [call site] 00335
5 mp_exch [function] [call site] 00336
5 mp_clear [function] [call site] 00337
5 mp_clear [function] [call site] 00338
5 mp_clear [function] [call site] 00339
4 s_mp_exptmod [function] [call site] 00340
2 dropbear_exit [function] [call site] 00341
2 mp_clear_multi [function] [call site] 00342
2 buf_put_pub_key [function] [call site] 00343
3 buf_new [function] [call site] 00344
3 buf_put_dss_pub_key [function] [call site] 00345
4 fail_assert [function] [call site] 00346
5 dropbear_exit [function] [call site] 00347
4 buf_putstring [function] [call site] 00348
5 buf_putint [function] [call site] 00349
6 buf_getwriteptr [function] [call site] 00350
7 dropbear_exit [function] [call site] 00351
6 buf_incrwritepos [function] [call site] 00352
7 dropbear_exit [function] [call site] 00353
5 buf_putbytes [function] [call site] 00354
6 buf_getwriteptr [function] [call site] 00355
6 buf_incrwritepos [function] [call site] 00356
4 buf_putmpint [function] [call site] 00357
5 fail_assert [function] [call site] 00358
5 dropbear_exit [function] [call site] 00359
5 mp_count_bits [function] [call site] 00360
5 buf_putint [function] [call site] 00361
5 buf_putbyte [function] [call site] 00362
6 buf_incrlen [function] [call site] 00363
7 dropbear_exit [function] [call site] 00364
5 buf_getwriteptr [function] [call site] 00365
5 mp_to_ubin [function] [call site] 00366
6 mp_ubin_size [function] [call site] 00367
7 mp_count_bits [function] [call site] 00368
6 mp_init_copy [function] [call site] 00369
6 mp_div_2d [function] [call site] 00370
6 mp_clear [function] [call site] 00371
5 dropbear_exit [function] [call site] 00372
5 buf_incrwritepos [function] [call site] 00373
4 buf_putmpint [function] [call site] 00374
4 buf_putmpint [function] [call site] 00375
4 buf_putmpint [function] [call site] 00376
3 buf_put_rsa_pub_key [function] [call site] 00377
4 buf_putstring [function] [call site] 00378
4 buf_putmpint [function] [call site] 00379
4 buf_putmpint [function] [call site] 00380
3 signkey_is_ecdsa [function] [call site] 00381
3 signkey_key_ptr [function] [call site] 00382
3 buf_put_ecdsa_pub_key [function] [call site] 00383
4 curve_for_dp [function] [call site] 00384
5 __assert_fail [call site] 00385
4 snprintf [call site] 00386
4 strlen [call site] 00387
4 buf_putstring [function] [call site] 00388
4 strlen [call site] 00389
4 buf_putstring [function] [call site] 00390
4 buf_put_ecc_raw_pubkey_string [function] [call site] 00391
5 buf_putint [function] [call site] 00392
5 buf_getwriteptr [function] [call site] 00393
5 ecc_ansi_x963_export [function] [call site] 00394
6 crypt_argchk [function] [call site] 00395
6 crypt_argchk [function] [call site] 00396
6 ltc_ecc_is_valid_idx [function] [call site] 00397
6 crypt_argchk [function] [call site] 00398
6 zeromem [function] [call site] 00399
7 m_burn [function] [call site] 00400
8 explicit_bzero [call site] 00401
6 zeromem [function] [call site] 00402
5 dropbear_exit [function] [call site] 00403
5 buf_incrwritepos [function] [call site] 00404
3 buf_put_ed25519_pub_key [function] [call site] 00405
4 fail_assert [function] [call site] 00406
4 buf_putstring [function] [call site] 00407
4 buf_putstring [function] [call site] 00408
3 dropbear_exit [function] [call site] 00409
3 buf_putbufstring [function] [call site] 00410
4 buf_putstring [function] [call site] 00411
3 buf_free [function] [call site] 00412
4 m_free_direct [function] [call site] 00413
2 buf_putmpint [function] [call site] 00414
2 buf_putmpint [function] [call site] 00415
2 buf_putmpint [function] [call site] 00416
2 finish_kexhashbuf [function] [call site] 00417
3 buf_setpos [function] [call site] 00418
4 dropbear_exit [function] [call site] 00419
3 buf_getptr [function] [call site] 00420
3 buf_new [function] [call site] 00421
3 buf_getwriteptr [function] [call site] 00422
3 buf_setlen [function] [call site] 00423
4 dropbear_exit [function] [call site] 00424
3 buf_burn_free [function] [call site] 00425
4 m_burn [function] [call site] 00426
4 m_free_direct [function] [call site] 00427
3 m_burn [function] [call site] 00428
3 buf_newcopy [function] [call site] 00429
4 buf_new [function] [call site] 00430
1 mp_clear [function] [call site] 00431
1 m_free_direct [function] [call site] 00432
1 mp_clear [function] [call site] 00433
1 buf_free [function] [call site] 00434
1 buf_free [function] [call site] 00435
1 m_malloc_free_epoch [function] [call site] 00436
2 put_alloc [function] [call site] 00437
1 m_malloc_free_epoch [function] [call site] 00438