Fuzz introspector: fuzzer-kexecdh
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
158 158 1 :

['buf_put_dss_pub_key']

335 433 buf_put_pub_key call site: 00261 /src/dropbear/src/signkey.c:427
158 158 1 :

['buf_put_rsa_pub_key']

177 275 buf_put_pub_key call site: 00262 /src/dropbear/src/signkey.c:432
99 99 1 :

['load_banner']

174 192 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:385
53 71 3 :

['exit', 'm_free_direct', 'sign_key_free']

53 71 svr_dropbear_exit call site: 00000 /src/dropbear/src/svr-session.c:291
21 21 1 :

['parse_recv_window']

73 89 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:401
20 29 2 :

['m_mp_free_multi', 'm_free_direct']

20 29 dss_key_free call site: 00000 /src/dropbear/src/dss.c:125
20 29 2 :

['m_mp_free_multi', 'm_free_direct']

20 29 rsa_key_free call site: 00000 /src/dropbear/src/rsa.c:146
20 20 1 :

['m_mp_free_multi']

20 20 buf_get_dss_priv_key call site: 00000 /src/dropbear/src/dss.c:113
20 20 1 :

['m_mp_free_multi']

20 20 buf_get_rsa_priv_key call site: 00000 /src/dropbear/src/rsa.c:133
19 19 1 :

['buf_put_ed25519_pub_key']

19 49 buf_put_pub_key call site: 00295 /src/dropbear/src/signkey.c:445
15 27 5 :

['getuid', 'm_malloc', 'strlen', 'getenv', 'fuzz_getpwuid']

15 43 expand_homedir_path call site: 00000 /src/dropbear/src/dbutil.c:640
13 13 1 :

['m_str_to_uint']

13 19 svr_getopts call site: 00000 /src/dropbear/src/svr-runopts.c:439

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fuzz_set_input [function] [call site] 00001
2 wrapfd_setup [function] [call site] 00002
3 wrapfd_remove [function] [call site] 00003
4 __assert_fail [call site] 00004
4 __assert_fail [call site] 00005
4 __assert_fail [call site] 00006
4 close [call site] 00007
3 wrapfd_setseed [function] [call site] 00008
4 nrand48 [call site] 00009
2 fuzz_seed [function] [call site] 00010
3 sha256_init [function] [call site] 00011
4 crypt_argchk [function] [call site] 00012
5 fprintf [call site] 00013
5 abort [call site] 00014
3 sha256_process [function] [call site] 00015
4 crypt_argchk [function] [call site] 00016
4 sha256_compress [function] [call site] 00017
3 sha256_process [function] [call site] 00018
3 sha256_done [function] [call site] 00019
4 crypt_argchk [function] [call site] 00020
4 crypt_argchk [function] [call site] 00021
4 sha256_compress [function] [call site] 00022
4 sha256_compress [function] [call site] 00023
1 m_malloc_set_epoch [function] [call site] 00024
1 _setjmp [call site] 00025
1 buf_getbyte [function] [call site] 00026
2 dropbear_exit [function] [call site] 00027
1 buf_getint [function] [call site] 00028
2 buf_getptr [function] [call site] 00029
3 dropbear_exit [function] [call site] 00030
2 buf_incrpos [function] [call site] 00031
3 dropbear_exit [function] [call site] 00032
1 buf_getstringbuf [function] [call site] 00033
2 buf_getstringbuf_int [function] [call site] 00034
3 buf_getint [function] [call site] 00035
3 dropbear_exit [function] [call site] 00036
3 buf_new [function] [call site] 00037
4 dropbear_exit [function] [call site] 00038
4 m_malloc [function] [call site] 00039
5 dropbear_exit [function] [call site] 00040
5 calloc [call site] 00041
5 dropbear_exit [function] [call site] 00042
5 put_alloc [function] [call site] 00043
6 __assert_fail [call site] 00044
6 __assert_fail [call site] 00045
3 buf_putint [function] [call site] 00046
4 buf_getwriteptr [function] [call site] 00047
5 dropbear_exit [function] [call site] 00048
4 buf_incrwritepos [function] [call site] 00049
5 dropbear_exit [function] [call site] 00050
3 buf_getwriteptr [function] [call site] 00051
3 buf_incrpos [function] [call site] 00052
3 buf_incrlen [function] [call site] 00053
4 dropbear_exit [function] [call site] 00054
3 buf_setpos [function] [call site] 00055
4 dropbear_exit [function] [call site] 00056
1 buf_new [function] [call site] 00057
1 kexecdh_comb_key [function] [call site] 00058
2 buf_get_ecc_raw_pubkey [function] [call site] 00059
3 buf_setpos [function] [call site] 00060
3 buf_getbyte [function] [call site] 00061
3 dropbear_log [function] [call site] 00062
3 new_ecc_key [function] [call site] 00063
4 m_malloc [function] [call site] 00064
4 m_mp_alloc_init_multi [function] [call site] 00065
5 m_malloc [function] [call site] 00066
5 mp_init [function] [call site] 00067
6 m_calloc [function] [call site] 00068
7 dropbear_exit [function] [call site] 00069
7 m_malloc [function] [call site] 00070
5 dropbear_exit [function] [call site] 00071
3 buf_getptr [function] [call site] 00072
3 mp_from_ubin [function] [call site] 00073
4 mp_grow [function] [call site] 00074
5 m_realloc_ltm [function] [call site] 00075
6 m_realloc [function] [call site] 00076
7 dropbear_exit [function] [call site] 00077
7 get_header [function] [call site] 00078
7 remove_alloc [function] [call site] 00079
7 realloc [call site] 00080
7 dropbear_exit [function] [call site] 00081
7 put_alloc [function] [call site] 00082
4 mp_zero [function] [call site] 00083
4 mp_mul_2d [function] [call site] 00084
5 mp_copy [function] [call site] 00085
6 mp_grow [function] [call site] 00086
5 mp_grow [function] [call site] 00087
5 mp_lshd [function] [call site] 00088
5 mp_clamp [function] [call site] 00089
4 mp_clamp [function] [call site] 00090
3 buf_incrpos [function] [call site] 00091
3 buf_getptr [function] [call site] 00092
3 mp_from_ubin [function] [call site] 00093
3 buf_incrpos [function] [call site] 00094
3 mp_set [function] [call site] 00095
3 ecc_is_point [function] [call site] 00096
4 m_mp_alloc_init_multi [function] [call site] 00097
4 mp_read_radix [function] [call site] 00098
5 mp_zero [function] [call site] 00099
5 mp_zero [function] [call site] 00100
5 mp_mul_d [function] [call site] 00101
6 mp_grow [function] [call site] 00102
6 mp_clamp [function] [call site] 00103
5 mp_add_d [function] [call site] 00104
6 mp_grow [function] [call site] 00105
6 mp_sub_d [function] [call site] 00106
7 mp_add_d [function] [call site] 00107
8 mp_clamp [function] [call site] 00108
8 mp_clamp [function] [call site] 00109
7 mp_clamp [function] [call site] 00110
5 mp_zero [function] [call site] 00111
4 mp_read_radix [function] [call site] 00112
4 mp_sqr [function] [call site] 00113
5 s_mp_sqr_fast [function] [call site] 00114
6 mp_grow [function] [call site] 00115
6 mp_clamp [function] [call site] 00116
5 s_mp_sqr [function] [call site] 00117
6 mp_init_size [function] [call site] 00118
7 m_calloc [function] [call site] 00119
6 mp_clamp [function] [call site] 00120
6 mp_exch [function] [call site] 00121
6 mp_clear [function] [call site] 00122
7 m_free_ltm [function] [call site] 00123
8 m_free_direct [function] [call site] 00124
9 get_header [function] [call site] 00125
9 remove_alloc [function] [call site] 00126
4 mp_sqr [function] [call site] 00127
4 mp_mod [function] [call site] 00128
5 mp_init_size [function] [call site] 00129
5 mp_div [function] [call site] 00130
6 mp_cmp_mag [function] [call site] 00131
6 mp_copy [function] [call site] 00132
6 mp_zero [function] [call site] 00133
6 mp_init_size [function] [call site] 00134
6 mp_init [function] [call site] 00135
6 mp_init [function] [call site] 00136
6 mp_init_copy [function] [call site] 00137
7 mp_init_size [function] [call site] 00138
7 mp_copy [function] [call site] 00139
7 mp_clear [function] [call site] 00140
6 mp_init_copy [function] [call site] 00141
6 mp_count_bits [function] [call site] 00142
6 mp_mul_2d [function] [call site] 00143
6 mp_mul_2d [function] [call site] 00144
6 mp_lshd [function] [call site] 00145
6 mp_cmp [function] [call site] 00146
7 mp_cmp_mag [function] [call site] 00147
7 mp_cmp_mag [function] [call site] 00148
6 mp_sub [function] [call site] 00149
7 s_mp_add [function] [call site] 00150
8 mp_grow [function] [call site] 00151
8 mp_clamp [function] [call site] 00152
7 mp_cmp_mag [function] [call site] 00153
7 s_mp_sub [function] [call site] 00154
8 mp_grow [function] [call site] 00155
8 mp_clamp [function] [call site] 00156
7 s_mp_sub [function] [call site] 00157
6 mp_rshd [function] [call site] 00158
6 mp_zero [function] [call site] 00159
6 mp_mul_d [function] [call site] 00160
6 mp_cmp_mag [function] [call site] 00161
6 mp_mul_d [function] [call site] 00162
6 mp_lshd [function] [call site] 00163
6 mp_sub [function] [call site] 00164
6 mp_copy [function] [call site] 00165
6 mp_lshd [function] [call site] 00166
6 mp_add [function] [call site] 00167
7 s_mp_add [function] [call site] 00168
7 mp_cmp_mag [function] [call site] 00169
7 s_mp_sub [function] [call site] 00170
7 s_mp_sub [function] [call site] 00171
6 mp_clamp [function] [call site] 00172
6 mp_exch [function] [call site] 00173
6 mp_div_2d [function] [call site] 00174
7 mp_zero [function] [call site] 00175
7 mp_copy [function] [call site] 00176
7 mp_mod_2d [function] [call site] 00177
8 mp_zero [function] [call site] 00178
8 mp_copy [function] [call site] 00179
8 mp_copy [function] [call site] 00180
8 mp_clamp [function] [call site] 00181
7 mp_rshd [function] [call site] 00182
7 mp_clamp [function] [call site] 00183
6 mp_exch [function] [call site] 00184
6 mp_clear [function] [call site] 00185
6 mp_clear [function] [call site] 00186
6 mp_clear [function] [call site] 00187
6 mp_clear [function] [call site] 00188
6 mp_clear [function] [call site] 00189
5 mp_exch [function] [call site] 00190
5 mp_add [function] [call site] 00191
5 mp_clear [function] [call site] 00192
4 mp_mul [function] [call site] 00193
5 s_mp_balance_mul [function] [call site] 00194
6 mp_init_size [function] [call site] 00195
6 mp_init_multi [function] [call site] 00196
7 mp_init [function] [call site] 00197
7 mp_clear [function] [call site] 00198
6 mp_clear [function] [call site] 00199
6 mp_lshd [function] [call site] 00200
6 mp_add [function] [call site] 00201
6 mp_clamp [function] [call site] 00202
6 mp_mul [function] [call site] 00203
7 s_mp_mul_digs_fast [function] [call site] 00204
8 mp_grow [function] [call site] 00205
8 mp_clamp [function] [call site] 00206
7 s_mp_mul_digs [function] [call site] 00207
8 s_mp_mul_digs_fast [function] [call site] 00208
8 mp_init_size [function] [call site] 00209
8 mp_clamp [function] [call site] 00210
8 mp_exch [function] [call site] 00211
8 mp_clear [function] [call site] 00212
6 mp_mul [function] [call site] 00213
6 mp_lshd [function] [call site] 00214
6 mp_add [function] [call site] 00215
6 mp_exch [function] [call site] 00216
6 mp_clear_multi [function] [call site] 00217
7 mp_clear [function] [call site] 00218
4 mp_sub [function] [call site] 00219
4 mp_add [function] [call site] 00220
4 mp_add [function] [call site] 00221
4 mp_add [function] [call site] 00222
4 mp_mod [function] [call site] 00223
4 mp_cmp_d [function] [call site] 00224
4 mp_add [function] [call site] 00225
4 mp_cmp [function] [call site] 00226
4 mp_sub [function] [call site] 00227
4 mp_cmp [function] [call site] 00228
4 mp_clear_multi [function] [call site] 00229
4 m_free_direct [function] [call site] 00230
4 m_free_direct [function] [call site] 00231
4 m_free_direct [function] [call site] 00232
4 m_free_direct [function] [call site] 00233
3 mp_cmp_d [function] [call site] 00234
3 mp_cmp_d [function] [call site] 00235
3 ecc_free [function] [call site] 00236
4 crypt_argchk [function] [call site] 00237
4 ltc_deinit_multi [function] [call site] 00238
3 m_free_direct [function] [call site] 00239
2 dropbear_exit [function] [call site] 00240
2 dropbear_ecc_shared_secret [function] [call site] 00241
3 ltc_ecc_new_point [function] [call site] 00242
4 m_calloc [function] [call site] 00243
4 ltc_init_multi [function] [call site] 00244
4 m_free_direct [function] [call site] 00245
3 m_malloc [function] [call site] 00246
3 m_mp_init [function] [call site] 00247
4 mp_init [function] [call site] 00248
4 dropbear_exit [function] [call site] 00249
3 mp_read_radix [function] [call site] 00250
3 m_malloc [function] [call site] 00251
3 m_mp_init [function] [call site] 00252
3 mp_copy [function] [call site] 00253
3 mp_clear [function] [call site] 00254
3 m_free_direct [function] [call site] 00255
3 ltc_ecc_del_point [function] [call site] 00256
4 ltc_deinit_multi [function] [call site] 00257
4 m_free_direct [function] [call site] 00258
3 dropbear_exit [function] [call site] 00259
2 buf_put_pub_key [function] [call site] 00260
3 buf_new [function] [call site] 00261
3 buf_put_dss_pub_key [function] [call site] 00262
4 fail_assert [function] [call site] 00263
5 dropbear_exit [function] [call site] 00264
4 buf_putstring [function] [call site] 00265
5 buf_putint [function] [call site] 00266
5 buf_putbytes [function] [call site] 00267
6 buf_getwriteptr [function] [call site] 00268
6 buf_incrwritepos [function] [call site] 00269
4 buf_putmpint [function] [call site] 00270
5 fail_assert [function] [call site] 00271
5 dropbear_exit [function] [call site] 00272
5 mp_count_bits [function] [call site] 00273
5 buf_putint [function] [call site] 00274
5 buf_putbyte [function] [call site] 00275
6 buf_incrlen [function] [call site] 00276
5 buf_getwriteptr [function] [call site] 00277
5 mp_to_ubin [function] [call site] 00278
6 mp_ubin_size [function] [call site] 00279
7 mp_count_bits [function] [call site] 00280
6 mp_init_copy [function] [call site] 00281
6 mp_div_2d [function] [call site] 00282
6 mp_clear [function] [call site] 00283
5 dropbear_exit [function] [call site] 00284
5 buf_incrwritepos [function] [call site] 00285
4 buf_putmpint [function] [call site] 00286
4 buf_putmpint [function] [call site] 00287
4 buf_putmpint [function] [call site] 00288
3 buf_put_rsa_pub_key [function] [call site] 00289
4 buf_putstring [function] [call site] 00290
4 buf_putmpint [function] [call site] 00291
4 buf_putmpint [function] [call site] 00292
3 signkey_is_ecdsa [function] [call site] 00293
3 signkey_key_ptr [function] [call site] 00294
3 buf_put_ecdsa_pub_key [function] [call site] 00295
4 curve_for_dp [function] [call site] 00296
5 __assert_fail [call site] 00297
4 snprintf [call site] 00298
4 strlen [call site] 00299
4 buf_putstring [function] [call site] 00300
4 strlen [call site] 00301
4 buf_putstring [function] [call site] 00302
4 buf_put_ecc_raw_pubkey_string [function] [call site] 00303
5 buf_putint [function] [call site] 00304
5 buf_getwriteptr [function] [call site] 00305
5 ecc_ansi_x963_export [function] [call site] 00306
6 crypt_argchk [function] [call site] 00307
6 crypt_argchk [function] [call site] 00308
6 ltc_ecc_is_valid_idx [function] [call site] 00309
6 crypt_argchk [function] [call site] 00310
6 zeromem [function] [call site] 00311
7 m_burn [function] [call site] 00312
8 explicit_bzero [call site] 00313
6 zeromem [function] [call site] 00314
5 dropbear_exit [function] [call site] 00315
5 buf_incrwritepos [function] [call site] 00316
3 buf_put_ed25519_pub_key [function] [call site] 00317
4 fail_assert [function] [call site] 00318
4 buf_putstring [function] [call site] 00319
4 buf_putstring [function] [call site] 00320
3 dropbear_exit [function] [call site] 00321
3 buf_putbufstring [function] [call site] 00322
4 buf_putstring [function] [call site] 00323
3 buf_free [function] [call site] 00324
4 m_free_direct [function] [call site] 00325
2 buf_put_ecc_raw_pubkey_string [function] [call site] 00326
2 buf_put_ecc_raw_pubkey_string [function] [call site] 00327
2 buf_putmpint [function] [call site] 00328
2 ecc_free [function] [call site] 00329
2 m_free_direct [function] [call site] 00330
2 finish_kexhashbuf [function] [call site] 00331
3 buf_setpos [function] [call site] 00332
3 buf_getptr [function] [call site] 00333
3 buf_new [function] [call site] 00334
3 buf_getwriteptr [function] [call site] 00335
3 buf_setlen [function] [call site] 00336
4 dropbear_exit [function] [call site] 00337
3 buf_burn_free [function] [call site] 00338
4 m_burn [function] [call site] 00339
4 m_free_direct [function] [call site] 00340
3 m_burn [function] [call site] 00341
3 buf_newcopy [function] [call site] 00342
4 buf_new [function] [call site] 00343
1 m_free_direct [function] [call site] 00344
1 buf_free [function] [call site] 00345
1 buf_free [function] [call site] 00346
1 buf_free [function] [call site] 00347
1 m_malloc_free_epoch [function] [call site] 00348
2 put_alloc [function] [call site] 00349