High level conclusions

Fuzzers reach 44.59% of cyclomatic complexity.

Fuzzers reach 36.91% of all functions.

Fuzzer gnutls_srp_server_fuzzer is blocked:

The runtime code coverage of gnutls_srp_server_fuzzer covers 0.929% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gnutls_srp_client_fuzzer is blocked:

The runtime code coverage of gnutls_srp_client_fuzzer covers 1.257% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gnutls_set_trust_file_fuzzer is blocked:

The runtime code coverage of gnutls_set_trust_file_fuzzer covers 4.472% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gnutls_reverse_idna_parser_fuzzer is blocked:

The runtime code coverage of gnutls_reverse_idna_parser_fuzzer covers 25.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gnutls_pkcs7_parser_fuzzer is blocked:

The runtime code coverage of gnutls_pkcs7_parser_fuzzer covers 5.759% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gnutls_x509_parser_fuzzer is blocked:

The runtime code coverage of gnutls_x509_parser_fuzzer covers 2.345% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1561 / 4229

Cyclomatic complexity statically reachable by fuzzers

16802 / 37678

Runtime code coverage of functions

1996 / 4229

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: gnutls_x509_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2891	99.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	15	0.51%
All colors	2906	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168
4	4	1 : View List ['rpl_free']	4	4	gl_linked_nx_create_empty	call site: 00000	/src/gnutls/gl/./gl_anylinked_list2.h:61

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

458

Reachable functions

469

Percentage of reachable functions covered

2.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_x509_parser_fuzzer.c	1
/src/gnutls/lib/x509/x509.c	33
/src/gnutls/lib/x509/./../fips.h	1
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./int.h	2
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/errors.c	2
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	3
/src/gnutls/lib/str.c	16
/src/nettle/base64-decode.c	4
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	30
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/x509/dn.c	2
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	1
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/algorithms/publickey.c	4
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/lib/pk.c	4
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/pubkey.c	12
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	1
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/algorithms/mac.c	5
/src/gnutls/lib/hash_int.c	2
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/mpi.c	6
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/algorithms/sign.c	9
/src/gnutls/lib/x509/key_encode.c	13
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/./fips.h	1
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	2
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/hello_ext.c	1
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/./algorithms.h	1

Fuzzer: gnutls_pkcs7_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	881	98.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	15	1.67%
All colors	896	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168
4	4	1 : View List ['rpl_free']	4	4	gl_linked_nx_create_empty	call site: 00000	/src/gnutls/gl/./gl_anylinked_list2.h:61

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

180

Reachable functions

191

Percentage of reachable functions covered

5.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_pkcs7_parser_fuzzer.c	1
/src/gnutls/lib/x509/pkcs7.c	13
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509_b64.c	5
/src/gnutls/lib/str.c	13
/src/nettle/base64-decode.c	4
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	2
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	14
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509/pkcs7-output.c	4
/src/gnutls/lib/mem.c	1
/src/gnutls/lib/algorithms/sign.c	5
/src/gnutls/lib/algorithms/publickey.c	1
/src/gnutls/lib/algorithms/mac.c	1
/src/gnutls/lib/hash_int.c	1
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/./common.h	2
/src/gnutls/lib/x509/pkcs7-attrs.c	3
/src/gnutls/lib/datum.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/dn.c	2
/src/nettle/base64-encode.c	2

Fuzzer: gnutls_reverse_idna_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	66.6%
gold	[1:9]	2	22.2%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	11.1%
All colors	9	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168
4	4	1 : View List ['rpl_free']	4	4	gl_linked_nx_create_empty	call site: 00000	/src/gnutls/gl/./gl_anylinked_list2.h:61

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

6

Reachable functions

8

Percentage of reachable functions covered

25.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_reverse_idna_parser_fuzzer.c	1
/src/gnutls/lib/str-idna.c	1
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1

Fuzzer: gnutls_ext_raw_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	12.2%
gold	[1:9]	1	2.04%
yellow	[10:29]	2	4.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	81.6%
All colors	49	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168
4	4	1 : View List ['rpl_free']	4	4	gl_linked_nx_create_empty	call site: 00000	/src/gnutls/gl/./gl_anylinked_list2.h:61

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

5

Reachable functions

10

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_ext_raw_parse_fuzzer.c	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/./num.h	1
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1

Fuzzer: gnutls_idna_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	23.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	6	46.1%
greenyellow	[30:49]	2	15.3%
lawngreen	50+	2	15.3%
All colors	13	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168
2	2	1 : View List ['_gnutls_priority_update_non_aesni']	2	2	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:942

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

5

Reachable functions

11

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_idna_parser_fuzzer.c	1
/src/gnutls/lib/str-idna.c	1
/src/gnutls/lib/./str.h	1
/src/gnutls/gl/./c-ctype.h	1
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/datum.c	1

Fuzzer: gnutls_set_trust_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3242	98.9%
gold	[1:9]	18	0.54%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	0.51%
All colors	3277	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5019	5099	3 : View List ['gnutls_x509_trust_list_add_trust_mem', 'rpl_free', '_gnutls_read_file']	5029	5109	gnutls_x509_trust_list_add_trust_file	call site: 00012	/src/gnutls/lib/x509/verify-high2.c:354
5019	5027	2 : View List ['gnutls_x509_trust_list_add_trust_mem', 'rpl_free']	5019	5027	gnutls_x509_trust_list_add_trust_file	call site: 00050	/src/gnutls/lib/x509/verify-high2.c:364
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	gnutls_certificate_allocate_credentials	call site: 00002	/src/gnutls/lib/cert-cred.c:412
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

534

Reachable functions

559

Percentage of reachable functions covered

4.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_set_trust_file_fuzzer.c	2
/src/gnutls/lib/cert-cred.c	3
/src/gnutls/lib/x509/verify-high.c	5
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/errors.c	3
/src/gnutls/gl/free.c	1
/src/gnutls/lib/cert-cred-x509.c	2
/src/gnutls/lib/x509/verify-high2.c	2
/src/gnutls/gl/read-file.c	2
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/memset_explicit.c	1
/src/gnutls/lib/x509/x509.c	41
/src/gnutls/lib/mem.c	3
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./int.h	2
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	4
/src/gnutls/lib/str.c	16
/src/nettle/base64-decode.c	4
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	34
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/x509/dn.c	4
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	1
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/x509/verify.c	10
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/algorithms/publickey.c	4
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/lib/pk.c	7
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/pubkey.c	17
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/algorithms/mac.c	5
/src/gnutls/lib/hash_int.c	2
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/./../num.h	6
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/mpi.c	6
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/algorithms/sign.c	9
/src/gnutls/lib/x509/key_encode.c	13
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/./fips.h	1
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	2
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/hello_ext.c	1
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/./algorithms.h	3
/src/gnutls/lib/x509/crl.c	9
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/pcert.c	1
/src/gnutls/lib/./str_array.h	1
/src/gnutls/lib/privkey.c	1
/src/gnutls/lib/x509/privkey.c	2
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_pkcs8_key_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1142	59.2%
gold	[1:9]	88	4.56%
yellow	[10:29]	29	1.50%
greenyellow	[30:49]	13	0.67%
lawngreen	50+	654	33.9%
All colors	1926	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
1508	1508	1 : View List ['__gmpn_toom42_mul']	1508	1508	__gmpn_mul	call site: 00000	/src/gmp/mpn/mul.c:264
1163	1163	2 : View List ['_x509_set_attribute', '_x509_encode_provable_seed']	1213	2102	encode_to_private_key_info	call site: 01711	/src/gnutls/lib/x509/privkey_pkcs8.c:240
1150	1150	2 : View List ['_gnutls_free_key_datum.7127', '_gnutls_x509_read_rsa_oaep_params']	1170	2094	_decode_pkcs8_rsa_oaep_key	call site: 00436	/src/gnutls/lib/x509/privkey_pkcs8.c:1021
1150	1150	1 : View List ['_gnutls_x509_read_rsa_oaep_params']	1150	1150	_gnutls_x509_read_pubkey_params	call site: 00551	/src/gnutls/lib/x509/key_decode.c:750
940	940	2 : View List ['_gnutls_free_key_datum.7127', '_gnutls_x509_read_rsa_pss_params']	977	1901	_decode_pkcs8_rsa_pss_key	call site: 00362	/src/gnutls/lib/x509/privkey_pkcs8.c:971
940	940	1 : View List ['_gnutls_x509_read_rsa_pss_params']	940	940	_gnutls_x509_read_pubkey_params	call site: 00551	/src/gnutls/lib/x509/key_decode.c:750
883	883	2 : View List ['_x509_decode_provable_seed', '_gnutls_log']	883	922	decode_private_key_info	call site: 00939	/src/gnutls/lib/x509/privkey_pkcs8.c:1548
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
729	729	1 : View List ['_gnutls_x509_write_rsa_oaep_params']	729	729	_gnutls_x509_write_pubkey_params	call site: 01426	/src/gnutls/lib/x509/key_encode.c:263
728	728	1 : View List ['_gnutls_x509_write_rsa_pss_params']	728	728	_gnutls_x509_write_pubkey_params	call site: 01426	/src/gnutls/lib/x509/key_encode.c:263
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383

Runtime coverage analysis

Covered functions

545

Functions that are reachable but not covered

121

Reachable functions

332

Percentage of reachable functions covered

63.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_pkcs8_key_parser_fuzzer.c	1
/src/gnutls/lib/x509/privkey.c	8
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	17
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509_b64.c	4
/src/gnutls/lib/str.c	3
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	5
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/algorithms/publickey.c	2
/src/gnutls/lib/x509/common.c	18
/src/gnutls/lib/mpi.c	10
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	8
/src/gnutls/lib/algorithms/mac.c	4
/src/gnutls/lib/hash_int.c	5
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	3
/src/gnutls/lib/x509/./../num.h	4
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
/src/gnutls/lib/datum.c	1
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	11
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/x509/attributes.c	4
/src/gnutls/lib/x509/prov-seed.c	2
/src/gnutls/lib/x509/pkcs7-crypt.c	18
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/algorithms/ciphers.c	3
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	2
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	9
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	1
/src/gnutls/lib/cipher_int.c	1
/src/gnutls/lib/./cipher_int.h	3
/src/gnutls/lib/algorithms/sign.c	2
/src/nettle/base64-encode.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1

Fuzzer: gnutls_pkcs12_key_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1246	48.2%
gold	[1:9]	164	6.35%
yellow	[10:29]	109	4.22%
greenyellow	[30:49]	46	1.78%
lawngreen	50+	1017	39.3%
All colors	2582	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
2133	2133	1 : View List ['_gnutls_gostdsa_unmask_key']	2143	2270	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4525
1673	1673	1 : View List ['_decode_pkcs8_dsa_key']	2566	3765	decode_private_key_info	call site: 01088	/src/gnutls/lib/x509/privkey_pkcs8.c:1505
1572	1572	2 : View List ['get_ecdh_curve', 'edwards_curve_mul_g']	1602	1602	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4461
1508	1508	1 : View List ['__gmpn_toom42_mul']	1508	1508	__gmpn_mul	call site: 00000	/src/gmp/mpn/mul.c:264
1240	1240	1 : View List ['_decode_pkcs8_rsa_oaep_key']	2133	3332	decode_private_key_info	call site: 01088	/src/gnutls/lib/x509/privkey_pkcs8.c:1505
1150	1150	1 : View List ['_gnutls_x509_read_rsa_oaep_params']	1150	1150	_gnutls_x509_read_pubkey_params	call site: 01239	/src/gnutls/lib/x509/key_decode.c:750
1039	1039	1 : View List ['_decode_pkcs8_rsa_pss_key']	1932	3131	decode_private_key_info	call site: 01088	/src/gnutls/lib/x509/privkey_pkcs8.c:1505
1031	1031	1 : View List ['_decode_pkcs8_ecc_key']	1924	3123	decode_private_key_info	call site: 01088	/src/gnutls/lib/x509/privkey_pkcs8.c:1505
940	940	1 : View List ['_gnutls_x509_read_rsa_pss_params']	940	940	_gnutls_x509_read_pubkey_params	call site: 01239	/src/gnutls/lib/x509/key_decode.c:750
904	904	4 : View List ['gnutls_idna_map', '_gnutls_x509_encode_string', '_gnutls_krb5_principal_to_der', 'virtual_to_othername_oid']	958	958	_gnutls_alt_name_assign_virt_type	call site: 02191	/src/gnutls/lib/x509/virt-san.c:75
883	883	2 : View List ['_x509_decode_provable_seed', '_gnutls_log']	883	922	decode_private_key_info	call site: 01595	/src/gnutls/lib/x509/privkey_pkcs8.c:1548

Runtime coverage analysis

Covered functions

699

Functions that are reachable but not covered

106

Reachable functions

457

Percentage of reachable functions covered

76.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_pkcs12_key_parser_fuzzer.c	1
/src/gnutls/lib/x509/pkcs12.c	15
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509_b64.c	3
/src/gnutls/lib/str.c	11
/src/nettle/base64-decode.c	4
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/common.c	25
/src/gnutls/lib/x509/pkcs7-crypt.c	15
/src/gnutls/lib/x509/./common.h	1
/src/gnutls/lib/x509/mpi.c	5
/src/gnutls/lib/x509/./../num.h	4
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
/src/gnutls/lib/algorithms/mac.c	4
/src/gnutls/lib/hash_int.c	8
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/crypto-api.c	12
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/mpi.c	10
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	2
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/dn.c	5
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/algorithms/ciphers.c	3
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/cipher_int.c	1
/src/gnutls/lib/./cipher_int.h	2
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/x509/privkey.c	6
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/gnutls/lib/pk.c	5
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/algorithms/publickey.c	3
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/x509.c	20
/src/gnutls/lib/algorithms/sign.c	2
/src/gnutls/lib/x509/x509_ext.c	12
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	2
/src/gnutls/lib/./str.h	1
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/pubkey.c	1
/src/gnutls/lib/x509/crl.c	4
/src/gnutls/lib/x509/verify.c	2
/src/gnutls/lib/x509/x509_dn.c	4

Fuzzer: gnutls_x509_crq_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1267	49.2%
gold	[1:9]	97	3.77%
yellow	[10:29]	122	4.74%
greenyellow	[30:49]	54	2.10%
lawngreen	50+	1030	40.0%
All colors	2570	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
904	904	4 : View List ['gnutls_idna_map', '_gnutls_x509_encode_string', '_gnutls_krb5_principal_to_der', 'virtual_to_othername_oid']	958	958	_gnutls_alt_name_assign_virt_type	call site: 01342	/src/gnutls/lib/x509/virt-san.c:75
873	873	2 : View List ['_gnutls_x509_read_dsa_pubkey', '_gnutls_log']	873	873	_gnutls_x509_read_pubkey	call site: 00737	/src/gnutls/lib/x509/key_decode.c:685
757	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	857	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
729	729	1 : View List ['_gnutls_x509_write_rsa_oaep_params']	729	729	_gnutls_x509_write_pubkey_params	call site: 02363	/src/gnutls/lib/x509/key_encode.c:263
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
711	711	1 : View List ['_gnutls_x509_write_dsa_params']	711	711	_gnutls_x509_write_pubkey_params	call site: 02363	/src/gnutls/lib/x509/key_encode.c:263
707	707	1 : View List ['_gnutls_x509_write_dsa_pubkey']	707	707	_gnutls_x509_write_pubkey	call site: 02507	/src/gnutls/lib/x509/key_encode.c:300
691	691	1 : View List ['_gnutls_x509_write_ecc_params']	691	691	_gnutls_x509_write_pubkey_params	call site: 02363	/src/gnutls/lib/x509/key_encode.c:263
621	621	1 : View List ['print_scts']	627	627	print_extension	call site: 02002	/src/gnutls/lib/x509/output.c:1315
210	210	1 : View List ['_gnutls_fbase64_decode']	230	230	gnutls_x509_crq_import	call site: 00082	/src/gnutls/lib/x509/crq.c:129
208	208	1 : View List ['asn1_decode_simple_ber']	240	456	_gnutls_x509_decode_string	call site: 00443	/src/gnutls/lib/x509/common.c:631
110	124	2 : View List ['gnutls_x509_name_constraints_init', '_gnutls_x509_name_constraints_merge']	150	3024	gnutls_x509_ext_import_name_constraints	call site: 02095	/src/gnutls/lib/x509/x509_ext.c:391

Runtime coverage analysis

Covered functions

374

Functions that are reachable but not covered

137

Reachable functions

424

Percentage of reachable functions covered

67.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_x509_crq_parser_fuzzer.c	1
/src/gnutls/lib/x509/crq.c	19
/src/gnutls/lib/x509/./../fips.h	1
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./int.h	2
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/errors.c	2
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509_b64.c	3
/src/gnutls/lib/str.c	16
/src/nettle/base64-decode.c	4
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	20
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509/output.c	33
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/x509/dn.c	2
/src/gnutls/lib/x509/common.c	27
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/algorithms/mac.c	4
/src/gnutls/lib/hash_int.c	2
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/pubkey.c	12
/src/gnutls/lib/./fips.h	1
/src/gnutls/lib/pk.c	4
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	1
/src/gnutls/lib/algorithms/publickey.c	3
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/lib/mpi.c	6
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/algorithms/secparams.c	2
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/algorithms/sign.c	6
/src/gnutls/lib/x509/x509.c	4
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	1
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/hello_ext.c	1
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/key_encode.c	13

Fuzzer: gnutls_client_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3303	62.0%
gold	[1:9]	170	3.19%
yellow	[10:29]	114	2.14%
greenyellow	[30:49]	40	0.75%
lawngreen	50+	1694	31.8%
All colors	5321	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9901	9901	1 : View List ['handshake_server']	10034	10184	gnutls_handshake	call site: 04153	/src/gnutls/lib/handshake.c:2874
8307	8339	7 : View List ['_gnutls_epoch_get', '_gnutls_cipher_to_entry', '_gnutls_log', '_gnutls_mac_to_entry', '_tls13_write_connection_state_init', '_gnutls_epoch_dup', '_gnutls13_send_early_data']	8307	8339	send_client_hello	call site: 04353	/src/gnutls/lib/handshake.c:2357
7557	15170	2 : View List ['_gnutls_recv_in_buffers', '_gnutls13_recv_async_handshake']	7577	15190	check_session_status	call site: 04646	/src/gnutls/lib/record.c:1637
7530	7530	1 : View List ['gnutls_reauth']	7540	7540	check_session_status	call site: 04646	/src/gnutls/lib/record.c:1637
4228	14266	13 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_tdiv_qr', '__gmp_divide_by_zero', '__gmpn_rshift', '__gmpn_powm', '__gmpn_sub', '__gmpn_mul', '__gmpn_binvert', '__gmpz_invert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n', '__gmpn_binvert_itch']	4234	14286	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:83
1695	1695	1 : View List ['_gnutls_proc_rawpk_crt']	1695	1695	_gnutls_proc_crt	call site: 00000	/src/gnutls/lib/auth/cert.c:1006
1617	1617	1 : View List ['gnutls_pcert_import_rawpk_raw']	1617	1617	_gnutls_get_auth_info_pcert	call site: 02545	/src/gnutls/lib/pcert.c:545
1591	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	1594	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
1574	1576	4 : View List ['__gmpz_init', '__gmpz_init_set_ui', '__gmpz_set_ui', '__gmpz_submul']	1574	6497	nettle_ecc_point_set	call site: 00000	/src/nettle/ecc-point.c:89
1508	1508	1 : View List ['__gmpn_toom42_mul']	1508	1508	__gmpn_mul	call site: 00000	/src/gmp/mpn/mul.c:264
1498	1498	1 : View List ['__gmpn_mul_fft']	1498	1514	__gmpn_mulmod_bnm1	call site: 00000	/src/gmp/mpn/mulmod_bnm1.c:246
1439	1439	3 : View List ['get_issuers_num', 'get_issuers', 'call_get_cert_callback']	1469	1469	_gnutls_select_client_cert	call site: 03835	/src/gnutls/lib/auth/cert.c:523

Runtime coverage analysis

Covered functions

1129

Functions that are reachable but not covered

416

Reachable functions

1038

Percentage of reachable functions covered

59.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_client_fuzzer.c	1
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	3
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	5
/src/gnutls/lib/algorithms/mac.c	10
/src/gnutls/lib/str.c	23
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	19
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	3
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/gl/./c-ctype.h	4
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/algorithms/sign.c	11
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/algorithms/ecc.c	8
/src/gnutls/lib/profiles.c	2
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/crypto-api.c	11
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/pcert.c	5
/src/gnutls/lib/pubkey.c	15
/src/gnutls/lib/pk.c	9
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/privkey.c	8
/src/gnutls/lib/x509/privkey.c	4
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/algorithms/publickey.c	5
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/x509/x509.c	19
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	7
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	21
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/x509/dn.c	3
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	2
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/mpi.c	4
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/x509/./../num.h	3
/src/gnutls/lib/mpi.c	5
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/ecc.c	1
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/x509/verify.c	1
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/algorithms/secparams.c	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/x509/crl.c	1
/src/gnutls/lib/./str_array.h	1
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_handshake_client_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4008	75.2%
gold	[1:9]	123	2.30%
yellow	[10:29]	53	0.99%
greenyellow	[30:49]	12	0.22%
lawngreen	50+	1130	21.2%
All colors	5326	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9901	9901	1 : View List ['handshake_server']	10034	10184	gnutls_handshake	call site: 04143	/src/gnutls/lib/handshake.c:2874
8307	8339	7 : View List ['_gnutls_epoch_get', '_gnutls_cipher_to_entry', '_gnutls_log', '_gnutls_mac_to_entry', '_tls13_write_connection_state_init', '_gnutls_epoch_dup', '_gnutls13_send_early_data']	8307	8339	send_client_hello	call site: 04344	/src/gnutls/lib/handshake.c:2357
7661	8015	5 : View List ['get_last_packet', '_gnutls_parse_record_buffered_msgs', '_gnutls_log', '_gnutls_recv_in_buffers', 'handshake_remaining_time']	7661	8015	_gnutls_handshake_io_recv_int	call site: 01337	/src/gnutls/lib/buffers.c:1396
7557	7557	1 : View List ['_gnutls13_recv_async_handshake']	7557	7557	gnutls_handshake_write	call site: 05267	/src/gnutls/lib/record.c:2513
4228	14266	13 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_tdiv_qr', '__gmp_divide_by_zero', '__gmpn_rshift', '__gmpn_powm', '__gmpn_sub', '__gmpn_mul', '__gmpn_binvert', '__gmpz_invert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n', '__gmpn_binvert_itch']	4234	14286	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:83
1617	1617	1 : View List ['gnutls_pcert_import_rawpk_raw']	1617	1617	_gnutls_get_auth_info_pcert	call site: 02533	/src/gnutls/lib/pcert.c:545
1591	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	1594	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
1574	1576	4 : View List ['__gmpz_init', '__gmpz_init_set_ui', '__gmpz_set_ui', '__gmpz_submul']	1574	6497	nettle_ecc_point_set	call site: 00000	/src/nettle/ecc-point.c:89
1542	1542	1 : View List ['nettle_curve448_mul']	1542	1542	edwards_curve_mul	call site: 00000	/src/gnutls/lib/nettle/pk.c:280
1529	1529	1 : View List ['__gmpn_toom32_mul']	1529	1529	__gmpn_mul	call site: 00000	/src/gmp/mpn/mul.c:264
1498	1498	1 : View List ['__gmpn_mul_fft']	1498	1514	__gmpn_mulmod_bnm1	call site: 00000	/src/gmp/mpn/mulmod_bnm1.c:246
1439	1439	3 : View List ['get_issuers_num', 'get_issuers', 'call_get_cert_callback']	1469	1469	_gnutls_select_client_cert	call site: 03825	/src/gnutls/lib/auth/cert.c:523

Runtime coverage analysis

Covered functions

802

Functions that are reachable but not covered

587

Reachable functions

1033

Percentage of reachable functions covered

43.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_handshake_client_fuzzer.c	2
/src/gnutls/lib/state.c	10
/src/gnutls/lib/./fips.h	3
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	5
/src/gnutls/lib/algorithms/mac.c	10
/src/gnutls/lib/str.c	23
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	3
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	19
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	3
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/gl/./c-ctype.h	4
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/algorithms/sign.c	11
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/algorithms/ecc.c	8
/src/gnutls/lib/profiles.c	2
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./handshake.h	4
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/record.c	19
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/crypto-api.c	11
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/pcert.c	5
/src/gnutls/lib/pubkey.c	15
/src/gnutls/lib/pk.c	9
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/privkey.c	8
/src/gnutls/lib/x509/privkey.c	4
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/algorithms/publickey.c	5
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/x509/x509.c	19
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	7
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	21
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/x509/dn.c	3
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	2
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/mpi.c	4
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/x509/./../num.h	3
/src/gnutls/lib/mpi.c	5
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/ecc.c	1
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/x509/verify.c	1
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	2
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/algorithms/secparams.c	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/x509/crl.c	1
/src/gnutls/lib/./str_array.h	1
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_dn_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	168	38.1%
gold	[1:9]	10	2.27%
yellow	[10:29]	2	0.45%
greenyellow	[30:49]	2	0.45%
lawngreen	50+	258	58.6%
All colors	440	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
767	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	867	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
448	1754	16 : View List ['_asn1_find_up', '_asn1_set_value_lv', '_asn1_get_indefinite_length_string', '_asn1_set_value', 'asn1_get_object_id_der', 'asn1_get_length_der', 'strlen', '_asn1_decode_simple_ber', 'delete_unneeded_choice_fields', '_asn1_delete_not_used', 'free', 'type_field.18219', '_asn1_append_sequence_set', '_asn1_get_time_der', 'asn1_get_tag_der', 'extract_tag_der_recursive']	448	1937	asn1_der_decoding2	call site: 00116	/src/libtasn1/lib/decoding.c:1101
208	208	1 : View List ['asn1_decode_simple_ber']	240	456	_gnutls_x509_decode_string	call site: 00392	/src/gnutls/lib/x509/common.c:631
113	151	3 : View List ['strtoul', 'asn1_get_length_der', 'asn1_get_length_ber']	113	304	_asn1_extract_tag_der	call site: 00087	/src/libtasn1/lib/decoding.c:568
109	109	1 : View List ['asn1_get_length_ber']	349	681	_gnutls_x509_decode_string	call site: 00390	/src/gnutls/lib/x509/common.c:619
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	18	2 : View List ['_gnutls_buffer_clear', '_gnutls_log']	10	18	_gnutls_buffer_to_datum	call site: 00432	/src/gnutls/lib/str.c:268
10	10	1 : View List ['_gnutls_log']	10	14	_gnutls_ucs2_to_utf8	call site: 00373	/src/gnutls/lib/str-iconv.c:97
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027

Runtime coverage analysis

Covered functions

138

Functions that are reachable but not covered

29

Reachable functions

116

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_dn_parser_fuzzer.c	1
/src/gnutls/lib/x509/x509_dn.c	4
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./int.h	2
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	19
/src/libtasn1/lib/element.c	5
/src/gnutls/gl/./c-ctype.h	2
/src/libtasn1/lib/coding.c	2
/src/gnutls/lib/x509/dn.c	2
/src/gnutls/lib/str.c	11
/src/gnutls/lib/x509/common.c	11
/src/gnutls/lib/mem.c	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../datum.h	1

Fuzzer: gnutls_ocsp_req_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	143	31.2%
gold	[1:9]	8	1.74%
yellow	[10:29]	8	1.74%
greenyellow	[30:49]	20	4.36%
lawngreen	50+	279	60.9%
All colors	458	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
761	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	861	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
208	208	1 : View List ['asn1_decode_simple_ber']	240	456	_gnutls_x509_decode_string	call site: 00380	/src/gnutls/lib/x509/common.c:631
109	109	1 : View List ['asn1_get_length_ber']	349	681	_gnutls_x509_decode_string	call site: 00378	/src/gnutls/lib/x509/common.c:619
75	75	1 : View List ['_gnutls_ucs2_to_utf8']	113	113	make_printable_string	call site: 00390	/src/gnutls/lib/x509/common.c:283
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
27	27	1 : View List ['_asn1_error_description_tag_error']	27	66	asn1_der_decoding2	call site: 00121	/src/libtasn1/lib/decoding.c:1108
18	18	2 : View List ['_gnutls_buffer_clear', '_gnutls_log']	18	18	_gnutls_buffer_to_datum	call site: 00449	/src/gnutls/lib/str.c:268
12	12	2 : View List ['atoi', '_gnutls_log']	12	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	3 : View List ['strlen', '_gnutls_free_datum.5460', '_gnutls_log']	12	12	_gnutls_x509_decode_string	call site: 00425	/src/gnutls/lib/x509/common.c:665
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027

Runtime coverage analysis

Covered functions

134

Functions that are reachable but not covered

41

Reachable functions

124

Percentage of reachable functions covered

66.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_ocsp_req_parser_fuzzer.c	1
/src/gnutls/lib/x509/ocsp.c	7
/src/libtasn1/lib/structure.c	9
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./int.h	2
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/errors.c	2
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	19
/src/libtasn1/lib/element.c	5
/src/gnutls/gl/./c-ctype.h	2
/src/libtasn1/lib/coding.c	2
/src/gnutls/lib/x509/ocsp_output.c	2
/src/gnutls/lib/str.c	13
/src/gnutls/lib/mem.c	1
/src/gnutls/lib/x509/common.c	6
/src/gnutls/lib/algorithms/mac.c	2
/src/gnutls/lib/hash_int.c	1
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/x509/extensions.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1

Fuzzer: gnutls_base64_decoder_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	23.5%
gold	[1:9]	5	9.80%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.96%
lawngreen	50+	33	64.7%
All colors	51	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_str_cat']	98	168	_gnutls_fbase64_decode	call site: 00008	/src/gnutls/lib/x509_b64.c:331
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

11

Reachable functions

24

Percentage of reachable functions covered

54.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_base64_decoder_fuzzer.c	1
/src/gnutls/lib/x509_b64.c	6
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/str.c	2
/src/nettle/base64-decode.c	4

Fuzzer: gnutls_server_rawpk_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4817	74.2%
gold	[1:9]	70	1.07%
yellow	[10:29]	40	0.61%
greenyellow	[30:49]	17	0.26%
lawngreen	50+	1547	23.8%
All colors	6491	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16795	16795	5 : View List ['_gnutls_retrieve_pin', 'gnutls_x509_privkey_import_pkcs8', 'gnutls_x509_privkey_import_openssl', '_gnutls_log', 'import_pkcs12_privkey']	16795	16795	gnutls_x509_privkey_import2	call site: 00122	/src/gnutls/lib/x509/privkey.c:746
9941	9941	1 : View List ['handshake_client']	10074	10224	gnutls_handshake	call site: 05357	/src/gnutls/lib/handshake.c:2874
7557	15170	2 : View List ['_gnutls_recv_in_buffers', '_gnutls13_recv_async_handshake']	7577	15190	check_session_status	call site: 05836	/src/gnutls/lib/record.c:1637
7530	7530	1 : View List ['gnutls_reauth']	7540	7540	check_session_status	call site: 05836	/src/gnutls/lib/record.c:1637
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
1718	3248	3 : View List ['__gmpz_mul', '__gmpz_sub', '__gmpz_divexact']	1718	3279	__gmpz_gcdext	call site: 00000	/src/gmp/mpz/gcdext.c:98
1587	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	1587	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
1574	1576	4 : View List ['__gmpz_init', '__gmpz_init_set_ui', '__gmpz_set_ui', '__gmpz_submul']	1574	6497	nettle_ecc_point_set	call site: 00000	/src/nettle/ecc-point.c:89
1542	1542	1 : View List ['nettle_curve448_mul']	1542	1542	edwards_curve_mul	call site: 00000	/src/gnutls/lib/nettle/pk.c:280
1498	1498	1 : View List ['__gmpn_mul_fft']	1498	1514	__gmpn_mulmod_bnm1	call site: 00000	/src/gmp/mpn/mulmod_bnm1.c:246
1157	1161	2 : View List ['server_recv_params', '_gnutls_get_cred']	1157	1161	_gnutls_psk_recv_params	call site: 00000	/src/gnutls/lib/ext/pre_shared_key.c:1216
1038	1038	3 : View List ['_gnutls_decrypt_session_ticket', 'unpack_session', '_gnutls_free_datum.8445']	1038	1038	session_ticket_recv_params	call site: 00000	/src/gnutls/lib/ext/session_ticket.c:376

Runtime coverage analysis

Covered functions

1129

Functions that are reachable but not covered

644

Reachable functions

1224

Percentage of reachable functions covered

47.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_server_rawpk_fuzzer.c	1
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/algorithms/mac.c	12
/src/gnutls/lib/str.c	24
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	19
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/cert-cred-rawpk.c	1
/src/gnutls/lib/cert-cred-x509.c	2
/src/gnutls/lib/privkey.c	13
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	4
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/algorithms/publickey.c	7
/src/gnutls/lib/x509/common.c	26
/src/gnutls/lib/mpi.c	11
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	5
/src/gnutls/lib/x509/./../num.h	4
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	19
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/dn.c	5
/src/gnutls/lib/x509/x509.c	23
/src/gnutls/lib/algorithms/sign.c	12
/src/gnutls/lib/x509/x509_ext.c	13
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	2
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/pubkey.c	15
/src/gnutls/lib/x509/crl.c	4
/src/gnutls/lib/x509/verify.c	3
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/pcert.c	5
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/profiles.c	2
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/nettle/base64-encode.c	2
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/algorithms/secparams.c	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_psk_client_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3984	74.9%
gold	[1:9]	85	1.59%
yellow	[10:29]	64	1.20%
greenyellow	[30:49]	23	0.43%
lawngreen	50+	1162	21.8%
All colors	5318	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9901	9901	1 : View List ['handshake_server']	10034	10184	gnutls_handshake	call site: 04164	/src/gnutls/lib/handshake.c:2874
8307	8339	7 : View List ['_gnutls_epoch_get', '_gnutls_cipher_to_entry', '_gnutls_log', '_gnutls_mac_to_entry', '_tls13_write_connection_state_init', '_gnutls_epoch_dup', '_gnutls13_send_early_data']	8307	8339	send_client_hello	call site: 04364	/src/gnutls/lib/handshake.c:2357
7557	15170	2 : View List ['_gnutls_recv_in_buffers', '_gnutls13_recv_async_handshake']	7577	15190	check_session_status	call site: 04657	/src/gnutls/lib/record.c:1637
7530	7530	1 : View List ['gnutls_reauth']	7540	7540	check_session_status	call site: 04657	/src/gnutls/lib/record.c:1637
3012	3012	7 : View List ['call_get_cert_callback', 'find_rawpk_client_cert', 'get_issuers_num', 'selected_certs_set', 'get_certificate_type.8788', 'get_issuers', 'find_x509_client_cert']	3052	3052	_gnutls_select_client_cert	call site: 03845	/src/gnutls/lib/auth/cert.c:516
1574	1576	4 : View List ['__gmpz_init', '__gmpz_init_set_ui', '__gmpz_set_ui', '__gmpz_submul']	1574	6497	nettle_ecc_point_set	call site: 00000	/src/nettle/ecc-point.c:89
1498	1498	1 : View List ['__gmpn_toom63_mul']	1498	3009	__gmpn_mul	call site: 00000	/src/gmp/mpn/mul.c:346
1498	1498	1 : View List ['__gmpn_mul_fft']	1498	1514	__gmpn_mulmod_bnm1	call site: 00000	/src/gmp/mpn/mulmod_bnm1.c:246
1157	1161	2 : View List ['server_recv_params', '_gnutls_get_cred']	1167	1171	_gnutls_psk_recv_params	call site: 00000	/src/gnutls/lib/ext/pre_shared_key.c:1171
1038	1038	3 : View List ['_gnutls_decrypt_session_ticket', 'unpack_session', '_gnutls_free_datum.8445']	1038	1038	session_ticket_recv_params	call site: 00000	/src/gnutls/lib/ext/session_ticket.c:380
767	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	867	871	_gnutls_update_system_priorities	call site: 00127	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383

Runtime coverage analysis

Covered functions

929

Functions that are reachable but not covered

600

Reachable functions

1038

Percentage of reachable functions covered

42.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_psk_client_fuzzer.c	1
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	3
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	5
/src/gnutls/lib/algorithms/mac.c	10
/src/gnutls/lib/str.c	24
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	19
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/psk.c	4
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/gl/./c-ctype.h	4
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/algorithms/sign.c	11
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/algorithms/ecc.c	8
/src/gnutls/lib/profiles.c	2
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/crypto-api.c	11
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/pcert.c	5
/src/gnutls/lib/pubkey.c	15
/src/gnutls/lib/pk.c	9
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/privkey.c	8
/src/gnutls/lib/x509/privkey.c	4
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/algorithms/publickey.c	5
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/x509/x509.c	19
/src/gnutls/lib/x509/./../fips.h	1
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	7
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	21
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/x509/dn.c	3
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	2
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/mpi.c	4
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/x509/./../num.h	3
/src/gnutls/lib/mpi.c	5
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/ecc.c	1
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/x509/verify.c	1
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/algorithms/secparams.c	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4

Fuzzer: gnutls_srp_client_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5279	99.4%
gold	[1:9]	12	0.22%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	15	0.28%
All colors	5306	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00110	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168
4	4	1 : View List ['rpl_free']	4	4	gl_linked_nx_create_empty	call site: 00000	/src/gnutls/gl/./gl_anylinked_list2.h:61

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

1021

Reachable functions

1034

Percentage of reachable functions covered

1.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_srp_client_fuzzer.c	1
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	3
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	5
/src/gnutls/lib/algorithms/mac.c	10
/src/gnutls/lib/str.c	23
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	19
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/srp.c	4
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/gl/./c-ctype.h	4
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/algorithms/sign.c	11
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/algorithms/ecc.c	8
/src/gnutls/lib/profiles.c	2
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/crypto-api.c	11
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/pcert.c	5
/src/gnutls/lib/pubkey.c	15
/src/gnutls/lib/pk.c	9
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/privkey.c	8
/src/gnutls/lib/x509/privkey.c	4
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/algorithms/publickey.c	5
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/x509/x509.c	19
/src/gnutls/lib/x509/./../fips.h	1
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	7
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	21
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/x509/dn.c	3
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	2
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/mpi.c	4
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/x509/./../num.h	3
/src/gnutls/lib/mpi.c	5
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/ecc.c	1
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/x509/verify.c	1
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/algorithms/secparams.c	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4

Fuzzer: gnutls_handshake_server_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6272	80.0%
gold	[1:9]	40	0.51%
yellow	[10:29]	14	0.17%
greenyellow	[30:49]	17	0.21%
lawngreen	50+	1490	19.0%
All colors	7833	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10925	16795	5 : View List ['_gnutls_retrieve_pin', 'gnutls_x509_privkey_import_pkcs8', 'gnutls_x509_privkey_import_openssl', '_gnutls_log', 'import_pkcs12_privkey']	10925	16795	gnutls_x509_privkey_import2	call site: 00122	/src/gnutls/lib/x509/privkey.c:746
9941	9941	1 : View List ['handshake_client']	10074	10224	gnutls_handshake	call site: 06694	/src/gnutls/lib/handshake.c:2874
7861	7884	5 : View List ['_gnutls_log', 'session_invalidate.11170', '_gnutls_handshake_hash_buffers_clear', 'gnutls_error_is_fatal', '_gnutls13_send_session_ticket']	7861	7886	_gnutls13_handshake_server	call site: 07495	/src/gnutls/lib/handshake-tls13.c:589
7661	8015	5 : View List ['get_last_packet', '_gnutls_parse_record_buffered_msgs', '_gnutls_log', '_gnutls_recv_in_buffers', 'handshake_remaining_time']	7661	8015	_gnutls_handshake_io_recv_int	call site: 05370	/src/gnutls/lib/buffers.c:1396
7557	7557	1 : View List ['_gnutls13_recv_async_handshake']	7557	7557	gnutls_handshake_write	call site: 07775	/src/gnutls/lib/record.c:2513
4746	4746	1 : View List ['parse_pem_cert_mem']	4756	4756	read_cert_mem	call site: 02698	/src/gnutls/lib/cert-cred-x509.c:298
4669	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	4672	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
2838	2838	1 : View List ['pkcs8_key_decode']	2858	2901	gnutls_x509_privkey_import_pkcs8	call site: 00199	/src/gnutls/lib/x509/privkey_pkcs8.c:1643
1787	1793	6 : View List ['_gnutls_ecdsa_compute_k_finish', '_gnutls_dsa_compute_k', 'nettle_ecc_size', '_gnutls_ecc_curve_to_dsa_q', 'nettle_ecc_bit_size', '__gmpz_limbs_read']	1797	4120	_wrap_nettle_pk_sign	call site: 00000	/src/gnutls/lib/nettle/pk.c:1622
1718	3248	3 : View List ['__gmpz_mul', '__gmpz_sub', '__gmpz_divexact']	1721	3279	__gmpz_gcdext	call site: 00000	/src/gmp/mpz/gcdext.c:98
1704	1704	1 : View List ['mpn_2powm']	1704	1704	__gmpn_powm	call site: 00000	/src/gmp/mpn/powm.c:580

Runtime coverage analysis

Covered functions

966

Functions that are reachable but not covered

839

Reachable functions

1388

Percentage of reachable functions covered

39.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_handshake_server_fuzzer.c	2
/src/gnutls/lib/state.c	10
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/algorithms/mac.c	13
/src/gnutls/lib/str.c	29
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	3
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	20
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/cert-cred-x509.c	8
/src/gnutls/lib/privkey.c	13
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	4
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/algorithms/publickey.c	8
/src/gnutls/lib/x509/common.c	33
/src/gnutls/lib/mpi.c	11
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	19
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/dn.c	6
/src/gnutls/lib/x509/x509.c	39
/src/gnutls/lib/algorithms/sign.c	16
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/pubkey.c	22
/src/gnutls/lib/x509/crl.c	4
/src/gnutls/lib/x509/verify.c	3
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/pcert.c	6
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	3
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/profiles.c	2
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./handshake.h	4
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/record.c	19
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	2
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_server_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5814	74.2%
gold	[1:9]	58	0.74%
yellow	[10:29]	31	0.39%
greenyellow	[30:49]	30	0.38%
lawngreen	50+	1893	24.1%
All colors	7826	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10925	16795	5 : View List ['_gnutls_retrieve_pin', 'gnutls_x509_privkey_import_pkcs8', 'gnutls_x509_privkey_import_openssl', '_gnutls_log', 'import_pkcs12_privkey']	10925	16795	gnutls_x509_privkey_import2	call site: 00122	/src/gnutls/lib/x509/privkey.c:746
9941	9941	1 : View List ['handshake_client']	10074	10224	gnutls_handshake	call site: 06701	/src/gnutls/lib/handshake.c:2874
7557	15170	2 : View List ['_gnutls_recv_in_buffers', '_gnutls13_recv_async_handshake']	7577	15190	check_session_status	call site: 07177	/src/gnutls/lib/record.c:1637
7530	7530	1 : View List ['gnutls_reauth']	7540	7540	check_session_status	call site: 07177	/src/gnutls/lib/record.c:1637
4746	4746	1 : View List ['parse_pem_cert_mem']	4756	4756	read_cert_mem	call site: 02698	/src/gnutls/lib/cert-cred-x509.c:298
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
2838	2838	1 : View List ['pkcs8_key_decode']	2858	2901	gnutls_x509_privkey_import_pkcs8	call site: 00199	/src/gnutls/lib/x509/privkey_pkcs8.c:1643
1787	1793	6 : View List ['_gnutls_ecdsa_compute_k_finish', '_gnutls_dsa_compute_k', 'nettle_ecc_size', '_gnutls_ecc_curve_to_dsa_q', 'nettle_ecc_bit_size', '__gmpz_limbs_read']	1797	4120	_wrap_nettle_pk_sign	call site: 00000	/src/gnutls/lib/nettle/pk.c:1622
1718	3248	3 : View List ['__gmpz_mul', '__gmpz_sub', '__gmpz_divexact']	1718	3279	__gmpz_gcdext	call site: 00000	/src/gmp/mpz/gcdext.c:98
1673	1673	1 : View List ['_decode_pkcs8_dsa_key']	2566	3765	decode_private_key_info	call site: 00430	/src/gnutls/lib/x509/privkey_pkcs8.c:1505
1587	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	1587	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
1574	1576	4 : View List ['__gmpz_init', '__gmpz_init_set_ui', '__gmpz_set_ui', '__gmpz_submul']	1574	6497	nettle_ecc_point_set	call site: 00000	/src/nettle/ecc-point.c:89

Runtime coverage analysis

Covered functions

1274

Functions that are reachable but not covered

717

Reachable functions

1393

Percentage of reachable functions covered

48.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_server_fuzzer.c	1
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/algorithms/mac.c	13
/src/gnutls/lib/str.c	29
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	20
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/cert-cred-x509.c	8
/src/gnutls/lib/privkey.c	13
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	4
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/algorithms/publickey.c	8
/src/gnutls/lib/x509/common.c	33
/src/gnutls/lib/mpi.c	11
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	19
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/dn.c	6
/src/gnutls/lib/x509/x509.c	39
/src/gnutls/lib/algorithms/sign.c	16
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/pubkey.c	22
/src/gnutls/lib/x509/crl.c	4
/src/gnutls/lib/x509/verify.c	3
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/pcert.c	6
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	3
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/profiles.c	2
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_base64_encoder_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	26.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	73.1%
All colors	41	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
10	10	1 : View List ['_gnutls_log']	10	10	gnutls_pem_base64_encode2	call site: 00007	/src/gnutls/lib/x509_b64.c:202
10	10	1 : View List ['_gnutls_log']	10	10	gnutls_base64_encode2	call site: 00039	/src/gnutls/lib/x509_b64.c:517
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

9

Reachable functions

19

Percentage of reachable functions covered

52.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_base64_encoder_fuzzer.c	1
/src/gnutls/lib/x509_b64.c	4
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/str.c	2
/src/nettle/base64-encode.c	2

Fuzzer: gnutls_ocsp_resp_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1506	47.2%
gold	[1:9]	248	7.78%
yellow	[10:29]	117	3.67%
greenyellow	[30:49]	20	0.62%
lawngreen	50+	1296	40.6%
All colors	3187	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2562	2562	1 : View List ['print_oneline']	2562	2617	gnutls_x509_crt_print	call site: 01942	/src/gnutls/lib/x509/output.c:2237
904	904	4 : View List ['gnutls_idna_map', '_gnutls_x509_encode_string', '_gnutls_krb5_principal_to_der', 'virtual_to_othername_oid']	958	958	_gnutls_alt_name_assign_virt_type	call site: 01056	/src/gnutls/lib/x509/virt-san.c:75
873	873	2 : View List ['_gnutls_x509_read_dsa_pubkey', '_gnutls_log']	873	873	_gnutls_x509_read_pubkey	call site: 01470	/src/gnutls/lib/x509/key_decode.c:685
873	873	1 : View List ['_gnutls_x509_read_ecc_params']	873	873	_gnutls_x509_read_pubkey_params	call site: 01312	/src/gnutls/lib/x509/key_decode.c:750
865	865	1 : View List ['_gnutls_x509_read_dsa_params']	865	865	_gnutls_x509_read_pubkey_params	call site: 01312	/src/gnutls/lib/x509/key_decode.c:750
757	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	857	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
729	729	1 : View List ['_gnutls_x509_write_rsa_oaep_params']	729	729	_gnutls_x509_write_pubkey_params	call site: 01641	/src/gnutls/lib/x509/key_encode.c:263
727	727	1 : View List ['_gnutls_x509_export_int_named2']	727	727	gnutls_x509_crt_export2	call site: 03148	/src/gnutls/lib/x509/x509.c:3115
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
711	711	1 : View List ['_gnutls_x509_write_dsa_params']	711	711	_gnutls_x509_write_pubkey_params	call site: 01641	/src/gnutls/lib/x509/key_encode.c:263
707	707	1 : View List ['_gnutls_x509_write_dsa_pubkey']	707	707	_gnutls_x509_write_pubkey	call site: 01788	/src/gnutls/lib/x509/key_encode.c:300
691	691	1 : View List ['_gnutls_x509_write_ecc_params']	691	691	_gnutls_x509_write_pubkey_params	call site: 01641	/src/gnutls/lib/x509/key_encode.c:263

Runtime coverage analysis

Covered functions

441

Functions that are reachable but not covered

141

Reachable functions

494

Percentage of reachable functions covered

71.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_ocsp_resp_parser_fuzzer.c	1
/src/gnutls/lib/x509/ocsp.c	16
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./int.h	2
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/errors.c	2
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509_b64.c	5
/src/gnutls/lib/str.c	16
/src/nettle/base64-decode.c	4
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	31
/src/gnutls/lib/x509/ocsp_output.c	2
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/dn.c	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/algorithms/mac.c	5
/src/gnutls/lib/hash_int.c	2
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/x509/./../algorithms.h	2
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/algorithms/sign.c	10
/src/gnutls/lib/x509/x509.c	34
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	1
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/algorithms/publickey.c	4
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/lib/pk.c	4
/src/gnutls/lib/pubkey.c	12
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	1
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/mpi.c	6
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/x509/key_encode.c	13
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/./fips.h	1
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	2
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/hello_ext.c	1
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/./algorithms.h	1

Fuzzer: gnutls_srp_server_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7801	99.6%
gold	[1:9]	12	0.15%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	15	0.19%
All colors	7828	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 04338	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
18	18	1 : View List ['_gnutls_asn2err']	40	40	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:306
12	12	2 : View List ['atoi', '_gnutls_log']	22	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	10	1 : View List ['_gnutls_log']	10	10	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:1027
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:67
10	10	1 : View List ['_gnutls_log']	10	10	_algo_register	call site: 00000	/src/gnutls/lib/crypto-backend.c:87
6	6	3 : View List ['gnutls_global_set_log_level', 'gnutls_global_set_log_function', 'atoi']	166	1986	_gnutls_global_init	call site: 00000	/src/gnutls/lib/global.c:262
4	4	2 : View List ['open', 'close']	44	44	_rnd_system_entropy_init	call site: 00000	/src/gnutls/lib/nettle/sysrng-linux.c:168
4	4	1 : View List ['rpl_free']	4	4	gl_linked_nx_create_empty	call site: 00000	/src/gnutls/gl/./gl_anylinked_list2.h:61

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

1385

Reachable functions

1398

Percentage of reachable functions covered

0.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_srp_server_fuzzer.c	2
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/algorithms/mac.c	13
/src/gnutls/lib/str.c	29
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	20
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/srp.c	4
/src/gnutls/lib/cert-cred-x509.c	8
/src/gnutls/lib/privkey.c	13
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	4
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/algorithms/publickey.c	8
/src/gnutls/lib/x509/common.c	33
/src/gnutls/lib/mpi.c	11
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	19
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/dn.c	6
/src/gnutls/lib/x509/x509.c	39
/src/gnutls/lib/algorithms/sign.c	16
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/pubkey.c	22
/src/gnutls/lib/x509/crl.c	4
/src/gnutls/lib/x509/verify.c	3
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/pcert.c	6
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	3
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/profiles.c	2
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_private_key_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	963	65.5%
gold	[1:9]	111	7.56%
yellow	[10:29]	37	2.52%
greenyellow	[30:49]	13	0.88%
lawngreen	50+	344	23.4%
All colors	1468	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
2831	2831	1 : View List ['pkcs8_key_decrypt']	2831	2870	pkcs8_key_decode	call site: 01031	/src/gnutls/lib/x509/privkey_pkcs8.c:919
1158	1795	8 : View List ['_gnutls_x509_dn_to_string', '_gnutls_x509_read_value', 'strcmp', 'asn1_read_value', '_gnutls_asn2err.13510', '_gnutls_str_cat', '_gnutls_str_cpy', '_gnutls_free_datum.13521']	1218	1855	_x509_parse_attribute	call site: 00955	/src/gnutls/lib/x509/attributes.c:96
883	883	2 : View List ['_x509_decode_provable_seed', '_gnutls_log']	883	922	decode_private_key_info	call site: 00952	/src/gnutls/lib/x509/privkey_pkcs8.c:1548
771	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	871	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
432	432	3 : View List ['memcmp', 'memmem', '_gnutls_fbase64_decode']	512	12093	gnutls_x509_privkey_import	call site: 00005	/src/gnutls/lib/x509/privkey.c:451
249	711	4 : View List ['_gnutls_x509_decode_string', '_gnutls_free_datum.6248', 'strcmp', '_gnutls_x509_read_null_value']	299	761	read_rsa_oaep_label	call site: 00470	/src/gnutls/lib/x509/key_decode.c:474
210	210	1 : View List ['_gnutls_fbase64_decode']	240	7983	gnutls_x509_privkey_import_pkcs8	call site: 00080	/src/gnutls/lib/x509/privkey_pkcs8.c:1611
116	116	1 : View List ['asn1_decode_simple_der']	148	364	_gnutls_x509_decode_string	call site: 00486	/src/gnutls/lib/x509/common.c:631
75	75	1 : View List ['_gnutls_ucs2_to_utf8']	113	113	make_printable_string	call site: 00496	/src/gnutls/lib/x509/common.c:283
56	56	1 : View List ['_gnutls_mpz_get_str_256_u_le']	56	56	wrap_nettle_mpi_print	call site: 00000	/src/gnutls/lib/nettle/mpi.c:64

Runtime coverage analysis

Covered functions

353

Functions that are reachable but not covered

149

Reachable functions

274

Percentage of reachable functions covered

45.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_private_key_parser_fuzzer.c	1
/src/gnutls/lib/x509/privkey.c	7
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/errors.c	1
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509_b64.c	3
/src/gnutls/lib/str.c	3
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	5
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	3
/src/gnutls/lib/algorithms/publickey.c	2
/src/gnutls/lib/x509/common.c	12
/src/gnutls/lib/mpi.c	10
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	8
/src/gnutls/lib/algorithms/mac.c	3
/src/gnutls/lib/hash_int.c	5
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	2
/src/gnutls/lib/x509/./../num.h	3
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
/src/gnutls/lib/datum.c	1
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	5
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	11
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/algorithms/ciphers.c	3
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	2
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	8
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	1
/src/gnutls/lib/cipher_int.c	1
/src/gnutls/lib/./cipher_int.h	2

Fuzzer: gnutls_x509_verify_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2598	76.3%
gold	[1:9]	74	2.17%
yellow	[10:29]	42	1.23%
greenyellow	[30:49]	5	0.14%
lawngreen	50+	682	20.0%
All colors	3401	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
145779	152319	10 : View List ['gnutls_pk_params_release', '_gnutls_log', 'gnutls_x509_crt_get_version', 'gnutls_sec_param_to_symmetric_bits', 'gnutls_pk_bits_to_sec_param', '_gnutls_sign_get_hash_strength', 'gnutls_x509_crt_print', 'gnutls_x509_crt_get_pk_algorithm', '_gnutls_sign_to_entry', '_gnutls_x509_crt_get_mpis']	145779	152319	is_level_acceptable	call site: 01172	/src/gnutls/lib/x509/verify.c:486
37755	47189	16 : View List ['__gmpn_toom33_mul', '__gmpn_toom44_mul', 'mpn_toom6h_mul_itch', '__gmpn_toom63_mul', '__gmp_tmp_reentrant_free', '__gmpn_toom8h_mul', 'mpn_toom8h_mul_itch', '__gmpn_mul', '__gmpn_toom43_mul', '__gmp_tmp_reentrant_alloc', '__gmpn_toom6h_mul', '__gmpn_toom22_mul', '__gmpn_toom42_mul', '__gmpn_nussbaumer_mul', '__gmpn_toom53_mul', '__gmpn_toom32_mul']	37755	47201	__gmpn_mul	call site: 00000	/src/gmp/mpn/mul.c:135
11506	11506	7 : View List ['gnutls_x509_name_constraints_check', 'gnutls_x509_crt_get_dn_by_oid', 'gnutls_x509_crt_get_subject_alt_name2', 'check_unsupported_constraint', 'check_unsupported_constraint2', '_gnutls_log', '_gnutls_check_key_purpose']	11506	11506	gnutls_x509_name_constraints_check_crt	call site: 03099	/src/gnutls/lib/x509/name_constraints.c:1181
4669	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	4672	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
1928	1928	2 : View List ['gnutls_x509_crt_check_issuer', '_gnutls_log']	1928	1928	check_if_ca	call site: 03247	/src/gnutls/lib/x509/verify.c:216
1908	1908	1 : View List ['gnutls_x509_crt_check_issuer']	7340	19121	_gnutls_verify_crt_status	call site: 00965	/src/gnutls/lib/x509/verify.c:969
1532	1532	2 : View List ['gnutls_x509_ext_import_name_constraints', '_gnutls_free_datum.6609']	1552	1552	gnutls_x509_crt_get_name_constraints	call site: 03093	/src/gnutls/lib/x509/name_constraints.c:507
990	6020	2 : View List ['verify_crt', '_gnutls_check_key_purpose']	1010	6047	_gnutls_verify_crt_status	call site: 03072	/src/gnutls/lib/x509/verify.c:1060
904	904	4 : View List ['gnutls_idna_map', '_gnutls_x509_encode_string', '_gnutls_krb5_principal_to_der', 'virtual_to_othername_oid']	958	958	_gnutls_alt_name_assign_virt_type	call site: 00600	/src/gnutls/lib/x509/virt-san.c:75
892	892	2 : View List ['gnutls_x509_ext_import_tlsfeatures', '_gnutls_log']	892	892	gnutls_x509_crt_get_tlsfeatures	call site: 03227	/src/gnutls/lib/x509/tls_features.c:137
873	873	2 : View List ['_gnutls_x509_read_dsa_pubkey', '_gnutls_log']	873	873	_gnutls_x509_read_pubkey	call site: 01317	/src/gnutls/lib/x509/key_decode.c:685
767	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	867	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286

Runtime coverage analysis

Covered functions

374

Functions that are reachable but not covered

302

Reachable functions

545

Percentage of reachable functions covered

44.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_x509_verify_fuzzer.c	2
/src/gnutls/lib/global.c	2
/src/gnutls/lib/system.c	1
/src/gnutls/lib/x509/x509.c	45
/src/gnutls/lib/x509/./../fips.h	1
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./int.h	2
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/errors.c	2
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	4
/src/gnutls/lib/str.c	16
/src/nettle/base64-decode.c	4
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	3
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	32
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/x509/dn.c	5
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	1
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/x509/verify.c	17
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/x509_dn.c	4
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/algorithms/mac.c	5
/src/gnutls/lib/hash_int.c	2
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/algorithms/sign.c	10
/src/gnutls/lib/priority.c	1
/src/gnutls/lib/algorithms/publickey.c	4
/src/gnutls/lib/algorithms/ecc.c	4
/src/gnutls/lib/pk.c	6
/src/gnutls/lib/pubkey.c	17
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/gnutls/lib/mpi.c	6
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/safe-memfuncs.c	1
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/x509/./../algorithms.h	1
/src/gnutls/lib/algorithms/secparams.c	3
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/x509/key_encode.c	13
/src/gnutls/lib/./datum.h	1
/src/gnutls/lib/./fips.h	1
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	25
/src/gnutls/lib/x509/tls_features.c	5
/src/gnutls/lib/hello_ext.c	1
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/./algorithms.h	3
/src/gnutls/lib/algorithms/./../algorithms.h	1
/src/gnutls/lib/x509/./ip-in-cidr.h	1
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/x509/supported_exts.gperf	2
/src/gnutls/lib/x509/crl.c	3

Fuzzer: gnutls_psk_server_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6183	78.9%
gold	[1:9]	51	0.65%
yellow	[10:29]	29	0.37%
greenyellow	[30:49]	14	0.17%
lawngreen	50+	1559	19.8%
All colors	7836	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10925	16795	5 : View List ['_gnutls_retrieve_pin', 'gnutls_x509_privkey_import_pkcs8', 'gnutls_x509_privkey_import_openssl', '_gnutls_log', 'import_pkcs12_privkey']	10925	16795	gnutls_x509_privkey_import2	call site: 00129	/src/gnutls/lib/x509/privkey.c:746
9941	9941	1 : View List ['handshake_client']	10074	10224	gnutls_handshake	call site: 06710	/src/gnutls/lib/handshake.c:2874
7557	15170	2 : View List ['_gnutls_recv_in_buffers', '_gnutls13_recv_async_handshake']	7577	15190	check_session_status	call site: 07186	/src/gnutls/lib/record.c:1637
7530	7530	1 : View List ['gnutls_reauth']	7540	7540	check_session_status	call site: 07186	/src/gnutls/lib/record.c:1637
4746	4746	1 : View List ['parse_pem_cert_mem']	4756	4756	read_cert_mem	call site: 02705	/src/gnutls/lib/cert-cred-x509.c:298
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
2838	2838	1 : View List ['pkcs8_key_decode']	2858	2901	gnutls_x509_privkey_import_pkcs8	call site: 00206	/src/gnutls/lib/x509/privkey_pkcs8.c:1643
1787	1793	6 : View List ['_gnutls_ecdsa_compute_k_finish', '_gnutls_dsa_compute_k', 'nettle_ecc_size', '_gnutls_ecc_curve_to_dsa_q', 'nettle_ecc_bit_size', '__gmpz_limbs_read']	1797	4120	_wrap_nettle_pk_sign	call site: 00000	/src/gnutls/lib/nettle/pk.c:1622
1718	3248	3 : View List ['__gmpz_mul', '__gmpz_sub', '__gmpz_divexact']	1718	3279	__gmpz_gcdext	call site: 00000	/src/gmp/mpz/gcdext.c:98
1673	1673	1 : View List ['_decode_pkcs8_dsa_key']	2566	3765	decode_private_key_info	call site: 00437	/src/gnutls/lib/x509/privkey_pkcs8.c:1505
1587	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	1587	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
1574	1576	4 : View List ['__gmpz_init', '__gmpz_init_set_ui', '__gmpz_set_ui', '__gmpz_submul']	1574	6497	nettle_ecc_point_set	call site: 00000	/src/nettle/ecc-point.c:89

Runtime coverage analysis

Covered functions

1122

Functions that are reachable but not covered

803

Reachable functions

1398

Percentage of reachable functions covered

42.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_psk_server_fuzzer.c	2
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/algorithms/mac.c	13
/src/gnutls/lib/str.c	29
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	20
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/psk.c	4
/src/gnutls/lib/cert-cred-x509.c	8
/src/gnutls/lib/privkey.c	13
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	4
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/algorithms/publickey.c	8
/src/gnutls/lib/x509/common.c	33
/src/gnutls/lib/mpi.c	11
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	7
/src/gnutls/lib/x509/./../num.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	19
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/dn.c	6
/src/gnutls/lib/x509/x509.c	39
/src/gnutls/lib/algorithms/sign.c	16
/src/gnutls/lib/x509/x509_ext.c	50
/src/gnutls/lib/x509/extensions.c	4
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/virt-san.c	4
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/x509/krb5.c	5
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/pubkey.c	22
/src/gnutls/lib/x509/crl.c	4
/src/gnutls/lib/x509/verify.c	3
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/pcert.c	6
/src/nettle/base64-encode.c	2
/src/gnutls/lib/x509/output.c	39
/src/gnutls/lib/x509/./../x509/x509_int.h	1
/src/gnutls/lib/algorithms/secparams.c	3
/src/gnutls/lib/x509/crq.c	3
/src/gnutls/lib/x509/ip.c	4
/src/gnutls/lib/x509/name_constraints.c	16
/src/gnutls/lib/x509/tls_features.c	3
/src/gnutls/lib/fingerprint.c	1
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/profiles.c	2
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_client_rawpk_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4392	67.6%
gold	[1:9]	201	3.09%
yellow	[10:29]	101	1.55%
greenyellow	[30:49]	20	0.30%
lawngreen	50+	1777	27.3%
All colors	6491	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16795	16795	5 : View List ['_gnutls_retrieve_pin', 'gnutls_x509_privkey_import_pkcs8', 'gnutls_x509_privkey_import_openssl', '_gnutls_log', 'import_pkcs12_privkey']	16795	16795	gnutls_x509_privkey_import2	call site: 00122	/src/gnutls/lib/x509/privkey.c:746
9901	9901	1 : View List ['handshake_server']	10034	10184	gnutls_handshake	call site: 05358	/src/gnutls/lib/handshake.c:2874
8307	8339	7 : View List ['_gnutls_epoch_get', '_gnutls_cipher_to_entry', '_gnutls_log', '_gnutls_mac_to_entry', '_tls13_write_connection_state_init', '_gnutls_epoch_dup', '_gnutls13_send_early_data']	8307	8339	send_client_hello	call site: 05551	/src/gnutls/lib/handshake.c:2357
7557	15170	2 : View List ['_gnutls_recv_in_buffers', '_gnutls13_recv_async_handshake']	7577	15190	check_session_status	call site: 05837	/src/gnutls/lib/record.c:1637
7530	7530	1 : View List ['gnutls_reauth']	7540	7540	check_session_status	call site: 05837	/src/gnutls/lib/record.c:1637
2852	2852	1 : View List ['calc_rsa_priv']	2922	7138	wrap_nettle_pk_fixup	call site: 00000	/src/gnutls/lib/nettle/pk.c:4389
1718	3248	3 : View List ['__gmpz_mul', '__gmpz_sub', '__gmpz_divexact']	1721	3279	__gmpz_gcdext	call site: 00000	/src/gmp/mpz/gcdext.c:98
1609	14266	13 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_tdiv_qr', '__gmp_divide_by_zero', '__gmpn_rshift', '__gmpn_powm', '__gmpn_sub', '__gmpn_mul', '__gmpn_binvert', '__gmpz_invert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n', '__gmpn_binvert_itch']	1615	14286	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:83
1591	7875	6 : View List ['__gmpn_powlo', '__gmpn_add', '__gmpn_mul', '__gmpn_binvert', '__gmp_tmp_reentrant_alloc', '__gmpn_mullo_n']	1594	7912	__gmpz_powm	call site: 00000	/src/gmp/mpz/powm.c:195
1574	1576	4 : View List ['__gmpz_init', '__gmpz_init_set_ui', '__gmpz_set_ui', '__gmpz_submul']	1574	6497	nettle_ecc_point_set	call site: 00000	/src/nettle/ecc-point.c:89
1508	1508	1 : View List ['__gmpn_toom42_mul']	1508	1508	__gmpn_mul	call site: 00000	/src/gmp/mpn/mul.c:264
1498	1498	1 : View List ['__gmpn_mul_fft']	1498	1514	__gmpn_mulmod_bnm1	call site: 00000	/src/gmp/mpn/mulmod_bnm1.c:246

Runtime coverage analysis

Covered functions

1236

Functions that are reachable but not covered

551

Reachable functions

1224

Percentage of reachable functions covered

54.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_client_rawpk_fuzzer.c	1
/src/gnutls/lib/state.c	9
/src/gnutls/lib/./fips.h	4
/src/gnutls/lib/errors.c	4
/src/gnutls/gl/free.c	1
/src/gnutls/lib/constate.c	26
/src/gnutls/lib/algorithms/ciphers.c	8
/src/gnutls/lib/algorithms/mac.c	12
/src/gnutls/lib/str.c	24
/src/gnutls/lib/mbuffers.c	15
/src/gnutls/lib/./buffers.h	6
/src/gnutls/lib/handshake.c	45
/src/gnutls/lib/./mem.h	2
/src/gnutls/lib/system_override.c	4
/src/gnutls/lib/system/sockets.c	3
/src/gnutls/lib/dtls.c	12
/src/gnutls/lib/ext/status_request.c	4
/src/gnutls/lib/hello_ext.c	19
/src/gnutls/lib/kx.c	19
/src/gnutls/gl/fopen.c	2
/src/gnutls/gl/glthread/lock.c	1
/src/gnutls/lib/cert-cred.c	6
/src/gnutls/lib/x509/verify-high.c	2
/src/gnutls/lib/x509/./../fips.h	1
/src/gnutls/lib/cert-cred-rawpk.c	1
/src/gnutls/lib/cert-cred-x509.c	2
/src/gnutls/lib/privkey.c	13
/src/gnutls/lib/x509/privkey.c	14
/src/gnutls/lib/x509_b64.c	4
/src/nettle/base64-decode.c	4
/src/gnutls/lib/pk.c	10
/src/gnutls/lib/safe-memfuncs.c	2
/src/gnutls/lib/./mpi.h	1
/src/gnutls/lib/x509/spki.c	2
/src/libtasn1/lib/structure.c	11
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/gnutls/lib/x509/privkey_pkcs8.c	13
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	4
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/algorithms/publickey.c	7
/src/gnutls/lib/x509/common.c	26
/src/gnutls/lib/mpi.c	11
/src/gnutls/lib/./errors.h	1
/src/gnutls/lib/x509/./../datum.h	2
/src/gnutls/lib/x509/key_decode.c	16
/src/gnutls/lib/hash_int.c	9
/src/gnutls/lib/crypto-backend.c	4
/src/gnutls/lib/x509/mpi.c	5
/src/gnutls/lib/x509/./../num.h	4
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/str-iconv.c	3
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	2
/src/gnutls/lib/extras/hex.c	3
/src/gnutls/lib/x509/./../mpi.h	1
/src/gnutls/lib/algorithms/ecc.c	10
/src/gnutls/gl/c-strcasecmp.c	1
/src/gnutls/lib/x509/key_encode.c	18
/src/gnutls/lib/x509/./../pk.h	1
/src/gnutls/lib/x509/./../algorithms.h	7
/src/gnutls/lib/ecc.c	2
/src/gnutls/lib/./datum.h	2
/src/gnutls/lib/x509/attributes.c	1
/src/gnutls/lib/x509/prov-seed.c	1
/src/gnutls/lib/x509/pkcs7-crypt.c	12
/src/gnutls/lib/x509/privkey_pkcs8_pbes1.c	5
/src/gnutls/lib/x509/pkcs12_encr.c	1
/src/libunistring/lib/unistr/u8-to-u16.c	1
/src/libunistring/lib/unistr/u8-mbtoucr.c	1
/src/libunistring/lib/unistr/u16-uctomb.c	1
/src/libunistring/lib/uninorm/u-normalize-internal.h	2
/src/libunistring/lib/unistr/u16-mbtouc-unsafe.c	1
/src/libunistring/lib/unictype/combiningclass.c	1
/src/libunistring/lib/./array-mergesort.h	3
/src/libunistring/lib/unistr/u-cpy.h	2
/src/gnutls/lib/x509/./../hash_int.h	1
/src/gnutls/lib/./algorithms.h	27
/src/gnutls/lib/str-unicode.c	3
/src/libunistring/lib/unistr/u8-check.c	1
/src/libunistring/lib/unistr/u8-to-u32.c	1
/src/libunistring/lib/unictype/categ_or.c	1
/src/libunistring/lib/unictype/categ_and_not.c	1
/src/libunistring/lib/unictype/pr_default_ignorable_code_point.c	1
/src/libunistring/lib/unictype/bitmap.h	1
/src/libunistring/lib/unictype/pr_not_a_character.c	1
/src/libunistring/lib/unictype/pr_join_control.c	1
/src/libunistring/lib/unictype/categ_test.c	1
/src/libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
/src/libunistring/lib/unistr/u32-uctomb.c	1
/src/libunistring/lib/unistr/u32-to-u8.c	1
/src/gnutls/lib/crypto-api.c	19
/src/gnutls/lib/fips.c	1
/src/gnutls/lib/./hash_int.h	3
/src/gnutls/lib/cipher_int.c	8
/src/gnutls/lib/./cipher_int.h	10
/src/gnutls/lib/pin.c	1
/src/gnutls/lib/x509/pkcs12.c	11
/src/gnutls/lib/x509/pkcs12_bag.c	8
/src/gnutls/lib/x509/dn.c	5
/src/gnutls/lib/x509/x509.c	23
/src/gnutls/lib/algorithms/sign.c	12
/src/gnutls/lib/x509/x509_ext.c	13
/src/gnutls/lib/x509/extensions.c	2
/src/gnutls/lib/mem.c	3
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	2
/src/gnutls/lib/./str.h	2
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/gl/hash.c	13
/src/gnutls/gl/hash-pjw-bare.c	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/pubkey.c	15
/src/gnutls/lib/x509/crl.c	4
/src/gnutls/lib/x509/verify.c	3
/src/gnutls/lib/x509/x509_dn.c	4
/src/gnutls/lib/x509/privkey_openssl.c	2
/src/gnutls/lib/pcert.c	5
/src/gnutls/lib/./x509/common.h	1
/src/gnutls/lib/./str_array.h	5
/src/gnutls/lib/auth.c	9
/src/gnutls/lib/./auth/cert.h	1
/src/gnutls/lib/priority.c	35
/src/gnutls/lib/inih/ini.c	5
/src/gnutls/lib/./name_val_array.h	4
/src/gnutls/lib/algorithms/protocols.c	14
/src/gnutls/lib/profiles.c	2
/src/gnutls/gl/c-strncasecmp.c	1
/src/gnutls/lib/algorithms/groups.c	3
/src/gnutls/lib/algorithms/kx.c	7
/src/gnutls/lib/algorithms/cert_types.c	2
/src/gnutls/lib/priority_options.gperf	2
/src/gnutls/lib/algorithms/ciphersuites.c	6
/src/gnutls/lib/./gnutls_int.h	4
/src/gnutls/fuzz/./mem.h	3
/src/gnutls/lib/record.c	20
/src/gnutls/lib/tls13/key_update.c	5
/src/gnutls/lib/./mbuffers.h	12
/src/gnutls/lib/buffers.c	25
/src/gnutls/lib/./dtls.h	5
/src/gnutls/lib/./record.h	6
/src/gnutls/lib/debug.c	2
/src/gnutls/lib/./num.h	9
/src/gnutls/lib/./constate.h	3
/src/gnutls/lib/cipher.c	9
/src/nettle/memxor.c	3
/src/gnutls/lib/cipher-cbc.c	2
/src/gnutls/lib/dtls-sw.c	2
/src/gnutls/lib/./crypto-api.h	2
/src/gnutls/lib/alert.c	2
/src/gnutls/lib/./debug.h	1
/src/gnutls/lib/iov.c	2
/src/gnutls/lib/random.c	2
/src/gnutls/gl/./gl_list.h	1
/src/gnutls/lib/./system.h	1
/src/gnutls/lib/handshake-tls13.c	7
/src/gnutls/lib/./handshake.h	2
/src/gnutls/lib/tls13/post_handshake.c	3
/src/gnutls/lib/tls13/certificate_request.c	7
/src/gnutls/lib/./extv.h	2
/src/gnutls/lib/extv.c	2
/src/gnutls/lib/ext/signature.c	6
/src/gnutls/lib/ext/./../algorithms.h	4
/src/gnutls/lib/ext/compress_certificate.c	6
/src/gnutls/lib/ext/./../num.h	6
/src/gnutls/lib/tls13/certificate.c	7
/src/gnutls/lib/sslv2_compat.c	2
/src/gnutls/lib/ext/safe_renegotiation.c	3
/src/gnutls/lib/ext/./../hello_ext.h	3
/src/gnutls/lib/algorithms/./../gnutls_int.h	1
/src/gnutls/lib/algorithms/./../hello_ext.h	1
/src/gnutls/lib/algorithms/./../algorithms.h	4
/src/gnutls/lib/auth/cert.c	14
/src/gnutls/lib/auth/./../gnutls_int.h	2
/src/gnutls/lib/auth/./../datum.h	1
/src/gnutls/lib/auth/./../auth/cert.h	1
/src/gnutls/lib/tls-sig.c	1
/src/gnutls/lib/auth/./../algorithms.h	1
/src/gnutls/lib/auth/./../ext/signature.h	1
/src/gnutls/lib/ext/./../gnutls_int.h	1
/src/gnutls/lib/ext/server_name.c	2
/src/gnutls/lib/hello_ext_lib.c	2
/src/gnutls/lib/auth/./../str_array.h	1
/src/gnutls/lib/algorithms/./../state.h	2
/src/gnutls/lib/db.c	5
/src/gnutls/lib/session.c	1
/src/gnutls/lib/session_pack.c	12
/src/gnutls/lib/./auth.h	1
/src/gnutls/lib/auth/dh_common.c	1
/src/gnutls/lib/./hello_ext.h	5
/src/gnutls/lib/secrets.c	7
/src/gnutls/lib/./state.h	3
/src/gnutls/lib/nettle/prf.c	1
/src/gnutls/lib/nettle/int/tls1-prf.c	3
/src/nettle/hmac-md5.c	3
/src/nettle/hmac.c	2
/src/nettle/md5.c	2
/src/nettle/hmac-sha1.c	3
/src/nettle/sha1.c	1
/src/nettle/sha1-compress.c	1
/src/nettle/hmac-sha256.c	3
/src/nettle/sha256.c	2
/src/nettle/sha256-compress-n.c	1
/src/nettle/hmac-sha384.c	2
/src/nettle/hmac-sha512.c	1
/src/nettle/sha512.c	2
/src/nettle/sha512-compress.c	1
/src/nettle/hmac-streebog.c	5
/src/nettle/streebog.c	4
/src/gnutls/lib/tls13/hello_retry.c	2
/src/gnutls/lib/compress.c	3
/src/gnutls/lib/dlwrap/zlibfuncs.h	3
/src/gnutls/lib/tls13/certificate_verify.c	2
/src/gnutls/lib/./ext/signature.h	2
/src/nettle/base64-encode.c	2
/src/gnutls/lib/tls13-sig.c	2
/src/gnutls/lib/handshake-checks.c	2
/src/gnutls/lib/tls13/finished.c	3
/src/gnutls/lib/auth/./../num.h	1
/src/gnutls/lib/auth/./../errors.h	1
/src/gnutls/lib/system/ktls.c	3
/src/gnutls/lib/tls13/session_ticket.c	6
/src/gnutls/lib/ext/pre_shared_key.c	2
/src/gnutls/lib/tls13/encrypted_extensions.c	2
/src/gnutls/lib/tls13/early_data.c	3
/src/gnutls/lib/ext/max_record.c	1
/src/gnutls/lib/supplemental.c	4
/src/gnutls/lib/ext/./../auth.h	1
/src/gnutls/lib/ext/session_ticket.c	6
/src/gnutls/lib/ext/./../dtls.h	1
/src/gnutls/lib/ext/./../buffers.h	1
/src/gnutls/lib/algorithms/secparams.c	1
/src/gnutls/lib/dh-session.c	2
/src/gnutls/lib/./tls13/session_ticket.h	2
/src/gnutls/lib/stek.c	6
/src/gnutls/lib/ext/./../cipher_int.h	2
/src/gnutls/lib/ext/./../hash_int.h	1
/src/gnutls/lib/ext/./../datum.h	1
/src/gnutls/lib/ext/./../mbuffers.h	4
/src/gnutls/lib/dh.c	1

Fuzzer: gnutls_x509_crl_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	480	40.6%
gold	[1:9]	49	4.14%
yellow	[10:29]	48	4.06%
greenyellow	[30:49]	25	2.11%
lawngreen	50+	580	49.0%
All colors	1182	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
904	904	4 : View List ['gnutls_idna_map', '_gnutls_x509_encode_string', '_gnutls_krb5_principal_to_der', 'virtual_to_othername_oid']	958	958	_gnutls_alt_name_assign_virt_type	call site: 00700	/src/gnutls/lib/x509/virt-san.c:75
757	771	5 : View List ['_gnutls_buffer_clear', 'construct_system_wide_priority_string', 'gnutls_strerror', 'load_system_priority_file', 'update_system_wide_priority_string']	857	871	_gnutls_update_system_priorities	call site: 00000	/src/gnutls/lib/priority.c:2286
725	2055	19 : View List ['read_cpuid_vals', 'check_padlock', 'check_fast_pclmul', 'check_pclmul', 'capabilities_to_intel_cpuid', 'check_sha', 'gnutls_crypto_single_digest_register', 'check_phe', 'gnutls_crypto_single_mac_register', '_gnutls_priority_update_non_aesni', 'check_avx_movbe', 'capabilities_to_zhaoxin_edx', 'check_ssse3', '_gnutls_log', 'check_optimized_aes', 'check_phe_sha512', 'check_phe_partial', 'gnutls_crypto_single_cipher_register', 'padlock_capability']	725	2055	register_x86_padlock_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:383
611	653	2 : View List ['asn1_der_decoding', 'asn1_find_node']	611	653	asn1_der_decoding_startEnd	call site: 00260	/src/libtasn1/lib/decoding.c:1702
208	208	1 : View List ['asn1_decode_simple_ber']	240	456	_gnutls_x509_decode_string	call site: 00462	/src/gnutls/lib/x509/common.c:631
109	109	1 : View List ['asn1_get_length_ber']	349	681	_gnutls_x509_decode_string	call site: 00460	/src/gnutls/lib/x509/common.c:619
105	105	1 : View List ['_gnutls_fbase64_decode']	145	1033	gnutls_x509_crl_import	call site: 00086	/src/gnutls/lib/x509/crl.c:133
48	48	1 : View List ['capabilities_to_intel_cpuid']	440	1304	register_x86_intel_crypto	call site: 00000	/src/gnutls/lib/accelerated/x86/x86-common.c:817
27	27	1 : View List ['_asn1_error_description_tag_error']	27	66	asn1_der_decoding2	call site: 00164	/src/libtasn1/lib/decoding.c:1108
12	12	2 : View List ['atoi', '_gnutls_log']	12	1562	lib_init	call site: 00000	/src/gnutls/lib/global.c:520
12	12	1 : View List ['_asn1_delete_list_and_nodes']	12	12	asn1_array2tree	call site: 00000	/src/libtasn1/lib/structure.c:272
10	18	2 : View List ['_gnutls_buffer_clear', '_gnutls_log']	10	18	_gnutls_buffer_to_datum	call site: 00501	/src/gnutls/lib/str.c:268

Runtime coverage analysis

Covered functions

216

Functions that are reachable but not covered

76

Reachable functions

239

Percentage of reachable functions covered

68.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/gnutls/fuzz/gnutls_x509_crl_parser_fuzzer.c	1
/src/gnutls/lib/x509/crl.c	16
/src/gnutls/lib/x509/./../fips.h	1
/src/libtasn1/lib/structure.c	10
/src/libtasn1/lib/parser_aux.c	12
/src/libtasn1/lib/./parser_aux.h	1
/src/libtasn1/lib/./gstr.h	1
/src/libtasn1/lib/gstr.c	2
/src/libtasn1/lib/./int.h	2
/src/gnutls/lib/errors.c	2
/src/gnutls/gl/free.c	1
/src/gnutls/lib/x509/./../errors.h	1
/src/gnutls/lib/x509/./../datum.h	1
/src/gnutls/lib/x509_b64.c	3
/src/gnutls/lib/str.c	15
/src/nettle/base64-decode.c	4
/src/gnutls/lib/datum.c	2
/src/gnutls/lib/x509/./common.h	1
/src/libtasn1/lib/decoding.c	21
/src/libtasn1/lib/element.c	6
/src/gnutls/gl/./c-ctype.h	2
/src/libtasn1/lib/coding.c	15
/src/gnutls/lib/x509/common.c	19
/src/gnutls/lib/x509/output.c	8
/src/gnutls/lib/mem.c	2
/src/gnutls/lib/x509/dn.c	2
/src/gnutls/lib/x509/./../extras/hex.h	1
/src/gnutls/lib/./extras/hex.h	1
/src/gnutls/lib/extras/hex.c	1
/src/gnutls/lib/str-iconv.c	2
/src/libunistring/lib/unistr/u16-to-u8.c	1
/src/libunistring/lib/unistr/u16-mbtoucr.c	1
/src/libunistring/lib/free.c	1
/src/libunistring/lib/unistr/u8-uctomb.c	1
/src/gnutls/lib/x509/./../str.h	1
/src/gnutls/lib/x509/time.c	5
/src/gnutls/lib/x509/extensions.c	5
/src/gnutls/lib/x509/x509_ext.c	8
/src/gnutls/lib/x509/x509.c	1
/src/gnutls/lib/x509/virt-san.c	2
/src/gnutls/lib/str-idna.c	4
/src/gnutls/lib/./str.h	1
/src/gnutls/lib/x509/krb5.c	3
/src/gnutls/lib/x509/ip.c	3
/src/gnutls/lib/x509/key_decode.c	2
/src/gnutls/lib/algorithms/mac.c	2
/src/gnutls/lib/hash_int.c	1
/src/gnutls/lib/crypto-backend.c	2
/src/gnutls/lib/x509/mpi.c	1
/src/gnutls/lib/x509/./../num.h	3
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
/src/gnutls/lib/algorithms/sign.c	8