Fuzz introspector: fuzz_jwt
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
15 27 google.auth.jwt.decode call site: 00027 google.auth.jwt._verify_iat_and_exp

Fuzzer calltree

0 ...fuzz_jwt.TestOneInput [function] [call site] 00000
1 ...fuzz_jwt.test_token_decode [function] [call site] 00001
2 atheris.FuzzedDataProvider [function] [call site] 00002
2 fdp.ConsumeString [function] [call site] 00003
2 google.auth.jwt.decode [function] [call site] 00004
3 google.auth.jwt._unverified_decode [function] [call site] 00005
4 google.auth._helpers.to_bytes [function] [call site] 00006
5 <builtin>.isinstance [function] [call site] 00007
5 value.encode [function] [call site] 00008
5 <builtin>.isinstance [function] [call site] 00009
4 token.count [function] [call site] 00010
4 token.split [function] [call site] 00011
4 google.auth._helpers.padded_urlsafe_b64decode [function] [call site] 00012
5 google.auth._helpers.to_bytes [function] [call site] 00013
5 <builtin>.len [function] [call site] 00014
5 base64.urlsafe_b64decode [function] [call site] 00015
4 google.auth.jwt._decode_jwt_segment [function] [call site] 00016
5 google.auth._helpers.padded_urlsafe_b64decode [function] [call site] 00017
5 section_bytes.decode [function] [call site] 00018
5 json.loads [function] [call site] 00019
5 google.auth.exceptions.GoogleAuthError.__init__ [function] [call site] 00020
6 <builtin>.super [function] [call site] 00021
6 kwargs.get [function] [call site] 00022
4 google.auth.jwt._decode_jwt_segment [function] [call site] 00023
4 <builtin>.isinstance [function] [call site] 00024
4 <builtin>.isinstance [function] [call site] 00025
3 header.get [function] [call site] 00026
3 header.get [function] [call site] 00027
3 <builtin>.isinstance [function] [call site] 00028
3 certs.values [function] [call site] 00029
3 google.auth.crypt.verify_signature [function] [call site] 00030
4 <builtin>.isinstance [function] [call site] 00031
4 verifier_cls.from_string [function] [call site] 00032
4 verifier.verify [function] [call site] 00033
3 google.auth.jwt._verify_iat_and_exp [function] [call site] 00034
4 google.auth._helpers.utcnow [function] [call site] 00035
5 datetime.datetime.now [function] [call site] 00036
5 now.replace [function] [call site] 00037
4 google.auth._helpers.datetime_to_secs [function] [call site] 00038
5 value.utctimetuple [function] [call site] 00039
5 calendar.timegm [function] [call site] 00040
3 payload.get [function] [call site] 00041
3 <builtin>.isinstance [function] [call site] 00042