Fuzz introspector: fuzzer-verify
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
244 244 1 :

['buf_sk_ecdsa_verify']

244 539 buf_verify call site: 00657 /src/dropbear/src/signkey.c:694
48 1203 5 :

['mp_exptmod', 'mp_invmod', 'mp_abs', 'mp_clear_multi', 'mp_init_multi']

48 1203 mp_exptmod call site: 00517 /src/dropbear/libtommath/bn_mp_exptmod.c:21
2 2 1 :

['exit']

2 2 generic_dropbear_exit call site: 00000 /src/dropbear/src/dbutil.c:124
0 261 2 :

['mp_mod', 'mp_set']

0 1386 s_mp_exptmod_fast call site: 00575 /src/dropbear/libtommath/bn_s_mp_exptmod_fast.c:122
0 226 1 :

['mp_mul']

0 656 mp_reduce call site: 00000 /src/dropbear/libtommath/bn_mp_reduce.c:25
0 216 3 :

['mp_read_radix', 'mp_set', 'mp_cmp']

0 989 mp_prime_is_prime call site: 00857 /src/dropbear/libtommath/bn_mp_prime_is_prime.c:147
0 102 5 :

['mp_grow', 'mp_rshd', 'mp_clamp', 's_mp_sub', 'mp_cmp_mag']

0 102 mp_montgomery_reduce call site: 00000 /src/dropbear/libtommath/bn_mp_montgomery_reduce.c:20
0 77 1 :

['ltc_ecc_projective_dbl_point']

0 81 ltc_ecc_projective_add_point call site: 00000 /src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c:51
0 75 1 :

['mp_add_d']

0 80 mp_sub_d call site: 00269 /src/dropbear/libtommath/bn_mp_sub_d.c:23
0 44 1 :

['mp_copy']

0 44 mp_div_d call site: 00799 /src/dropbear/libtommath/bn_mp_div_d.c:21
0 41 4 :

['mp_exch', 'mp_clamp', 'mp_init_size', 'mp_clear']

0 41 s_mp_mul_digs call site: 00364 /src/dropbear/libtommath/bn_s_mp_mul_digs.c:24
0 26 1 :

['mp_grow']

0 114 mp_from_ubin call site: 00173 /src/dropbear/libtommath/bn_mp_from_ubin.c:12

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 setup_fuzzer [function] [call site] 00001
2 fuzz_common_setup [function] [call site] 00002
3 disallow_core [function] [call site] 00003
4 getrlimit [call site] 00004
4 setrlimit [call site] 00005
3 m_malloc [function] [call site] 00006
4 dropbear_exit [function] [call site] 00007
4 calloc [call site] 00008
4 dropbear_exit [function] [call site] 00009
4 put_alloc [function] [call site] 00010
5 __assert_fail [call site] 00011
5 __assert_fail [call site] 00012
3 fuzz_dropbear_log [function] [call site] 00013
3 crypto_init [function] [call site] 00014
4 register_cipher [function] [call site] 00015
5 crypt_argchk [function] [call site] 00016
6 fprintf [call site] 00017
6 abort [call site] 00018
4 dropbear_exit [function] [call site] 00019
4 register_hash [function] [call site] 00020
5 memcmp [call site] 00021
4 dropbear_exit [function] [call site] 00022
4 register_prng [function] [call site] 00023
4 dropbear_exit [function] [call site] 00024
4 mp_rand_source [function] [call site] 00025
4 dropbear_rand_source [function] [call site] 00026
5 genrandom [function] [call site] 00027
6 dropbear_exit [function] [call site] 00028
6 sha256_init [function] [call site] 00029
7 crypt_argchk [function] [call site] 00030
6 sha256_process [function] [call site] 00031
7 crypt_argchk [function] [call site] 00032
7 sha256_compress [function] [call site] 00033
6 sha256_process [function] [call site] 00034
6 sha256_done [function] [call site] 00035
7 crypt_argchk [function] [call site] 00036
7 crypt_argchk [function] [call site] 00037
7 sha256_compress [function] [call site] 00038
7 sha256_compress [function] [call site] 00039
6 seedrandom [function] [call site] 00040
7 sha256_init [function] [call site] 00041
7 sha256_process [function] [call site] 00042
7 process_getrandom [function] [call site] 00043
8 getrandom [call site] 00044
8 __errno_location [call site] 00045
8 __errno_location [call site] 00046
8 dropbear_log [function] [call site] 00047
8 getrandom [call site] 00048
8 __errno_location [call site] 00049
8 sha256_process [function] [call site] 00050
7 process_file [function] [call site] 00051
8 open [call site] 00052
8 wrapfd_read [function] [call site] 00053
9 read [call site] 00054
9 __errno_location [call site] 00055
9 __assert_fail [call site] 00056
9 erand48 [call site] 00057
9 __errno_location [call site] 00058
9 erand48 [call site] 00059
9 __errno_location [call site] 00060
9 nrand48 [call site] 00061
9 buf_getptr [function] [call site] 00062
9 buf_incrpos [function] [call site] 00063
10 dropbear_exit [function] [call site] 00064
9 nrand48 [call site] 00065
8 __errno_location [call site] 00066
8 sha256_process [function] [call site] 00067
8 wrapfd_close [function] [call site] 00068
9 wrapfd_remove [function] [call site] 00069
10 __assert_fail [call site] 00070
10 __assert_fail [call site] 00071
10 __assert_fail [call site] 00072
10 close [call site] 00073
9 close [call site] 00074
7 dropbear_exit [function] [call site] 00075
7 process_file [function] [call site] 00076
7 process_file [function] [call site] 00077
7 process_file [function] [call site] 00078
7 process_file [function] [call site] 00079
7 process_file [function] [call site] 00080
7 process_file [function] [call site] 00081
7 process_file [function] [call site] 00082
7 process_file [function] [call site] 00083
7 process_file [function] [call site] 00084
7 getpid [call site] 00085
7 sha256_process [function] [call site] 00086
7 gettimeofday [call site] 00087
7 sha256_process [function] [call site] 00088
7 clock [call site] 00089
7 sha256_process [function] [call site] 00090
7 sha256_done [function] [call site] 00091
7 write_urandom [function] [call site] 00092
8 fopen [call site] 00093
8 genrandom [function] [call site] 00094
9 m_burn [function] [call site] 00095
10 explicit_bzero [call site] 00096
8 fwrite [call site] 00097
8 fclose [call site] 00098
4 dropbear_ecc_fill_dp [function] [call site] 00099
5 dropbear_exit [function] [call site] 00100
3 fuzz_seed [function] [call site] 00101
4 sha256_init [function] [call site] 00102
4 sha256_process [function] [call site] 00103
4 sha256_process [function] [call site] 00104
4 sha256_done [function] [call site] 00105
3 setlinebuf [call site] 00106
3 getenv [call site] 00107
3 fprintf [call site] 00108
3 fprintf [call site] 00109
3 fopen [call site] 00110
3 __assert_fail [call site] 00111
1 buf_new [function] [call site] 00112
2 dropbear_exit [function] [call site] 00113
1 buf_putstring [function] [call site] 00115
2 buf_putint [function] [call site] 00116
3 buf_getwriteptr [function] [call site] 00117
4 dropbear_exit [function] [call site] 00118
3 buf_incrwritepos [function] [call site] 00119
4 dropbear_exit [function] [call site] 00120
2 buf_putbytes [function] [call site] 00121
3 buf_getwriteptr [function] [call site] 00122
3 buf_incrwritepos [function] [call site] 00123
1 fuzz_set_input [function] [call site] 00124
2 wrapfd_setup [function] [call site] 00125
3 wrapfd_remove [function] [call site] 00126
3 wrapfd_setseed [function] [call site] 00127
2 fuzz_seed [function] [call site] 00128
1 m_malloc_set_epoch [function] [call site] 00129
1 new_sign_key [function] [call site] 00130
1 buf_get_pub_key [function] [call site] 00132
2 buf_getstring [function] [call site] 00133
3 buf_getint [function] [call site] 00134
4 buf_getptr [function] [call site] 00135
4 buf_incrpos [function] [call site] 00136
3 dropbear_exit [function] [call site] 00137
3 buf_getptr [function] [call site] 00138
3 buf_incrpos [function] [call site] 00140
2 signkey_type_from_name [function] [call site] 00141
3 strlen [call site] 00142
3 memcmp [call site] 00143
2 m_free_direct [function] [call site] 00144
3 get_header [function] [call site] 00145
3 remove_alloc [function] [call site] 00146
2 buf_decrpos [function] [call site] 00147
3 dropbear_exit [function] [call site] 00148
2 dss_key_free [function] [call site] 00149
3 m_mp_free_multi [function] [call site] 00150
4 mp_clear [function] [call site] 00151
5 m_free_ltm [function] [call site] 00152
6 m_free_direct [function] [call site] 00153
4 m_free_direct [function] [call site] 00154
3 m_free_direct [function] [call site] 00155
2 buf_get_dss_pub_key [function] [call site] 00157
3 fail_assert [function] [call site] 00158
4 dropbear_exit [function] [call site] 00159
3 m_mp_alloc_init_multi [function] [call site] 00160
4 dropbear_exit [function] [call site] 00166
3 buf_incrpos [function] [call site] 00167
3 buf_getmpint [function] [call site] 00168
4 buf_getint [function] [call site] 00169
4 buf_getptr [function] [call site] 00171
4 buf_getptr [function] [call site] 00172
4 mp_from_ubin [function] [call site] 00173
4 buf_incrpos [function] [call site] 00191
3 buf_getmpint [function] [call site] 00192
3 buf_getmpint [function] [call site] 00193
3 buf_getmpint [function] [call site] 00194
3 mp_count_bits [function] [call site] 00195
3 mp_count_bits [function] [call site] 00196
3 dropbear_log [function] [call site] 00197
3 dropbear_log [function] [call site] 00199
3 dropbear_log [function] [call site] 00203
3 m_mp_free_multi [function] [call site] 00204
2 dss_key_free [function] [call site] 00205
2 rsa_key_free [function] [call site] 00206
3 m_mp_free_multi [function] [call site] 00207
3 m_free_direct [function] [call site] 00208
2 buf_get_rsa_pub_key [function] [call site] 00210
3 fail_assert [function] [call site] 00211
3 m_mp_alloc_init_multi [function] [call site] 00212
3 buf_incrpos [function] [call site] 00213
3 buf_getmpint [function] [call site] 00214
3 buf_getmpint [function] [call site] 00215
3 mp_count_bits [function] [call site] 00216
3 dropbear_log [function] [call site] 00217
3 mp_count_bits [function] [call site] 00218
3 m_mp_free_multi [function] [call site] 00219
2 rsa_key_free [function] [call site] 00220
2 signkey_is_ecdsa [function] [call site] 00221
2 signkey_key_ptr [function] [call site] 00222
2 ecc_free [function] [call site] 00223
3 crypt_argchk [function] [call site] 00224
3 ltc_deinit_multi [function] [call site] 00225
2 m_free_direct [function] [call site] 00226
2 buf_get_ecdsa_pub_key [function] [call site] 00227
3 buf_getstring [function] [call site] 00228
3 buf_getstring [function] [call site] 00229
3 strcmp [call site] 00230
3 strlen [call site] 00231
3 buf_getstringbuf [function] [call site] 00232
4 buf_getstringbuf_int [function] [call site] 00233
5 buf_getint [function] [call site] 00234
5 dropbear_exit [function] [call site] 00235
5 buf_putint [function] [call site] 00237
5 buf_getwriteptr [function] [call site] 00238
5 buf_incrpos [function] [call site] 00239
5 buf_incrlen [function] [call site] 00240
6 dropbear_exit [function] [call site] 00241
5 buf_setpos [function] [call site] 00242
6 dropbear_exit [function] [call site] 00243
3 buf_get_ecc_raw_pubkey [function] [call site] 00244
4 buf_setpos [function] [call site] 00245
4 buf_getbyte [function] [call site] 00246
5 dropbear_exit [function] [call site] 00247
4 dropbear_log [function] [call site] 00248
4 new_ecc_key [function] [call site] 00249
5 m_mp_alloc_init_multi [function] [call site] 00251
4 buf_getptr [function] [call site] 00252
4 mp_from_ubin [function] [call site] 00253
4 buf_incrpos [function] [call site] 00254
4 buf_getptr [function] [call site] 00255
4 mp_from_ubin [function] [call site] 00256
4 buf_incrpos [function] [call site] 00257
4 ecc_is_point [function] [call site] 00259
5 m_mp_alloc_init_multi [function] [call site] 00260
5 mp_read_radix [function] [call site] 00275
5 mp_mod [function] [call site] 00287
6 mp_init_size [function] [call site] 00288
6 mp_div [function] [call site] 00289
7 mp_cmp_mag [function] [call site] 00290
7 mp_init_size [function] [call site] 00293
7 mp_init_copy [function] [call site] 00296
7 mp_init_copy [function] [call site] 00300
7 mp_count_bits [function] [call site] 00301
7 mp_mul_2d [function] [call site] 00302
7 mp_mul_2d [function] [call site] 00303
7 mp_cmp_mag [function] [call site] 00318
5 mp_clear_multi [function] [call site] 00386
5 m_free_direct [function] [call site] 00387
5 m_free_direct [function] [call site] 00388
5 m_free_direct [function] [call site] 00389
4 m_free_direct [function] [call site] 00393
3 m_free_direct [function] [call site] 00394
3 m_free_direct [function] [call site] 00395
3 buf_free [function] [call site] 00396
4 m_free_direct [function] [call site] 00397
2 ed25519_key_free [function] [call site] 00398
3 m_free_direct [function] [call site] 00400
2 buf_get_ed25519_pub_key [function] [call site] 00402
3 buf_getstring [function] [call site] 00403
3 signkey_type_from_name [function] [call site] 00404
3 buf_getint [function] [call site] 00405
3 buf_getptr [function] [call site] 00407
3 buf_incrpos [function] [call site] 00408
2 m_free_direct [function] [call site] 00409
2 buf_getstring [function] [call site] 00410
1 buf_getbyte [function] [call site] 00411
1 signature_type_from_signkey [function] [call site] 00412
2 __assert_fail [call site] 00413
2 __assert_fail [call site] 00414
1 buf_verify [function] [call site] 00415
2 buf_getint [function] [call site] 00416
2 buf_getstring [function] [call site] 00417
2 signature_type_from_name [function] [call site] 00418
3 memcmp [call site] 00419
3 memcmp [call site] 00420
3 signkey_type_from_name [function] [call site] 00421
2 m_free_direct [function] [call site] 00422
2 dropbear_exit [function] [call site] 00423
2 signkey_type_from_signature [function] [call site] 00424
3 __assert_fail [call site] 00425
2 dropbear_exit [function] [call site] 00426
2 buf_dss_verify [function] [call site] 00427
3 fail_assert [function] [call site] 00428
3 m_mp_init_multi [function] [call site] 00429
4 dropbear_exit [function] [call site] 00431
3 buf_getstring [function] [call site] 00432
3 sha1_init [function] [call site] 00433
4 crypt_argchk [function] [call site] 00434
3 sha1_process [function] [call site] 00435
4 crypt_argchk [function] [call site] 00436
3 sha1_done [function] [call site] 00439
4 crypt_argchk [function] [call site] 00440
4 crypt_argchk [function] [call site] 00441
4 sha1_compress [function] [call site] 00442
4 sha1_compress [function] [call site] 00443
3 bytes_to_mp [function] [call site] 00444
4 mp_from_ubin [function] [call site] 00445
4 dropbear_exit [function] [call site] 00446
3 mp_invmod [function] [call site] 00449
3 bytes_to_mp [function] [call site] 00508
3 bytes_to_mp [function] [call site] 00513
3 mp_mulmod [function] [call site] 00516
3 mp_exptmod [function] [call site] 00517
4 mp_init_multi [function] [call site] 00518
4 mp_invmod [function] [call site] 00519
4 mp_exptmod [function] [call site] 00522
5 mp_clear_multi [function] [call site] 00523
5 mp_reduce_is_2k_l [function] [call site] 00524
5 mp_dr_is_modulus [function] [call site] 00559
5 mp_reduce_is_2k [function] [call site] 00560
6 mp_count_bits [function] [call site] 00561
5 s_mp_exptmod_fast [function] [call site] 00562
5 s_mp_exptmod [function] [call site] 00599
3 mp_exptmod [function] [call site] 00600
3 mp_mulmod [function] [call site] 00601
3 mp_clear_multi [function] [call site] 00604
2 dropbear_exit [function] [call site] 00605
2 buf_rsa_verify [function] [call site] 00606
3 fail_assert [function] [call site] 00607
3 m_mp_init_multi [function] [call site] 00608
3 buf_getint [function] [call site] 00609
3 mp_ubin_size [function] [call site] 00610
4 mp_count_bits [function] [call site] 00611
3 buf_getptr [function] [call site] 00612
3 mp_from_ubin [function] [call site] 00613
3 rsa_pad_em [function] [call site] 00615
4 __assert_fail [call site] 00616
4 mp_ubin_size [function] [call site] 00617
4 buf_putbyte [function] [call site] 00619
5 buf_incrlen [function] [call site] 00620
4 buf_putbyte [function] [call site] 00621
4 buf_putbyte [function] [call site] 00622
4 buf_putbyte [function] [call site] 00623
4 buf_putbytes [function] [call site] 00624
4 buf_getwriteptr [function] [call site] 00625
4 buf_incrwritepos [function] [call site] 00626
4 fail_assert [function] [call site] 00627
4 buf_setpos [function] [call site] 00628
4 buf_getptr [function] [call site] 00629
4 bytes_to_mp [function] [call site] 00630
3 mp_exptmod [function] [call site] 00632
3 mp_clear_multi [function] [call site] 00634
2 signkey_is_ecdsa [function] [call site] 00635
2 signkey_key_ptr [function] [call site] 00636
2 buf_ecdsa_verify [function] [call site] 00637
3 curve_for_dp [function] [call site] 00638
4 __assert_fail [call site] 00639
3 ltc_ecc_new_point [function] [call site] 00640
4 ltc_init_multi [function] [call site] 00642
4 m_free_direct [function] [call site] 00643
3 ltc_ecc_new_point [function] [call site] 00644
3 ltc_init_multi [function] [call site] 00645
3 dropbear_exit [function] [call site] 00646
3 buf_get_ecdsa_verify_params [function] [call site] 00647
4 buf_getint [function] [call site] 00648
4 buf_getmpint [function] [call site] 00649
4 buf_getmpint [function] [call site] 00650
3 ltc_ecc_del_point [function] [call site] 00651
4 ltc_deinit_multi [function] [call site] 00652
4 m_free_direct [function] [call site] 00653
3 ltc_ecc_del_point [function] [call site] 00654
3 ltc_deinit_multi [function] [call site] 00655
2 dropbear_exit [function] [call site] 00656
2 buf_ed25519_verify [function] [call site] 00657
3 fail_assert [function] [call site] 00658
3 buf_getptr [function] [call site] 00659
3 dropbear_ed25519_verify [function] [call site] 00660
4 sha512_init [function] [call site] 00700
5 crypt_argchk [function] [call site] 00701
4 sha512_process [function] [call site] 00702
5 sha512_compress [function] [call site] 00703
4 sha512_process [function] [call site] 00704
4 sha512_process [function] [call site] 00705
4 sha512_done [function] [call site] 00706
5 crypt_argchk [function] [call site] 00707
5 crypt_argchk [function] [call site] 00708
5 sha512_compress [function] [call site] 00709
5 sha512_compress [function] [call site] 00710
4 crypto_verify_32 [function] [call site] 00756
2 signkey_key_ptr [function] [call site] 00757
2 buf_sk_ecdsa_verify [function] [call site] 00758
3 buf_getbuf [function] [call site] 00759
4 buf_getstringbuf_int [function] [call site] 00760
3 buf_getbyte [function] [call site] 00761
3 buf_getint [function] [call site] 00762
3 sha256_init [function] [call site] 00764
3 sha256_process [function] [call site] 00765
3 sha256_done [function] [call site] 00766
3 buf_putbytes [function] [call site] 00767
3 buf_putbyte [function] [call site] 00768
3 buf_putint [function] [call site] 00769
3 sha256_init [function] [call site] 00770
3 sha256_process [function] [call site] 00771
3 sha256_done [function] [call site] 00772
3 buf_putbytes [function] [call site] 00773
3 buf_ecdsa_verify [function] [call site] 00774
3 dropbear_log [function] [call site] 00777
2 signkey_key_ptr [function] [call site] 00778
2 buf_sk_ed25519_verify [function] [call site] 00779
3 fail_assert [function] [call site] 00780
3 buf_getptr [function] [call site] 00781
3 buf_incrpos [function] [call site] 00782
3 sha256_process [function] [call site] 00784
3 sha256_done [function] [call site] 00785
3 buf_putbytes [function] [call site] 00786
3 sha256_init [function] [call site] 00787
3 sha256_process [function] [call site] 00788
3 sha256_done [function] [call site] 00789
3 buf_putbytes [function] [call site] 00790
3 dropbear_ed25519_verify [function] [call site] 00791
2 dropbear_exit [function] [call site] 00793
1 mp_count_bits [function] [call site] 00794
1 mp_prime_rabin_miller_trials [function] [call site] 00795
1 mp_prime_is_prime [function] [call site] 00796
2 s_mp_prime_is_divisible [function] [call site] 00833
2 mp_prime_miller_rabin [function] [call site] 00857
2 mp_read_radix [function] [call site] 00858
2 mp_read_radix [function] [call site] 00860
2 mp_prime_miller_rabin [function] [call site] 00863
2 mp_count_bits [function] [call site] 00864
2 s_floor_ilog2 [function] [call site] 00865
2 mp_count_bits [function] [call site] 00868
2 mp_div_2d [function] [call site] 00869
2 mp_prime_miller_rabin [function] [call site] 00871
1 __assert_fail [call site] 00873
1 mp_count_bits [function] [call site] 00874
1 mp_prime_rabin_miller_trials [function] [call site] 00875
1 mp_prime_is_prime [function] [call site] 00876
1 __assert_fail [call site] 00877
1 signkey_key_ptr [function] [call site] 00878
1 printf [call site] 00879
1 abort [call site] 00880
1 sign_key_free [function] [call site] 00881
2 dss_key_free [function] [call site] 00882
2 rsa_key_free [function] [call site] 00883
2 m_free_direct [function] [call site] 00885
2 m_free_direct [function] [call site] 00887
2 m_free_direct [function] [call site] 00889
2 ed25519_key_free [function] [call site] 00890
2 m_free_direct [function] [call site] 00891
2 m_free_direct [function] [call site] 00892
2 m_free_direct [function] [call site] 00893
1 m_malloc_free_epoch [function] [call site] 00894
2 put_alloc [function] [call site] 00895
1 m_malloc_free_epoch [function] [call site] 00896