Fuzz introspector: sae
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
84 84 1 :

['sae_parse_commit_element_ffc']

84 84 sae_parse_commit_element call site: 00117 /src/hostap/src/common/sae.c:2042
13 13 2 :

['__ctype_b_loc', 'wpa_debug_print_timestamp']

13 13 _wpa_hexdump_ascii call site: 00179 /src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11 11 1 :

['wpa_debug_print_timestamp']

11 11 _wpa_hexdump call site: 00090 /src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
4 4 2 :

['BN_num_bits', 'BN_bn2bin']

4 4 crypto_bignum_to_bin call site: 00145 /src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:1937
3 125 3 :

['crypto_bignum_init_set', 'dh_groups_get', 'sae_clear_data']

3 125 sae_set_group call site: 00056 /src/hostap/src/common/sae.c:46
2 2 1 :

['atoi']

2 2 wpa_fuzzer_set_debug_level call site: 00002 /src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0 0 None 6 6 crypto_ec_point_from_bin call site: 00159 /src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2483
0 0 None 4 233 sae_parse_commit call site: 00117 /src/hostap/src/common/sae.c:2186
0 0 None 3 226 sae_set_group call site: 00022 /src/hostap/src/common/sae.c:33
0 0 None 0 34 sae_parse_rejected_groups call site: 00209 /src/hostap/src/common/sae.c:2119
0 0 None 0 29 sae_parse_password_identifier call site: 00177 /src/hostap/src/common/sae.c:2087
0 0 None 0 7 sae_parse_commit_scalar call site: 00103 /src/hostap/src/common/sae.c:1911

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 wpa_fuzzer_set_debug_level [function] [call site] 00001
2 getenv [call site] 00002
2 atoi [call site] 00003
1 os_program_init [function] [call site] 00004
2 os_get_random [function] [call site] 00005
2 srandom [call site] 00006
1 sae_parse_commit [function] [call site] 00007
2 WPA_GET_LE16 [function] [call site] 00008
2 sae_group_allowed [function] [call site] 00009
3 wpa_printf [function] [call site] 00010
4 wpa_debug_print_timestamp [function] [call site] 00011
5 os_get_time [function] [call site] 00012
6 gettimeofday [call site] 00013
5 fprintf [call site] 00014
5 printf [call site] 00015
4 vfprintf [call site] 00016
4 fprintf [call site] 00017
4 vprintf [call site] 00018
4 printf [call site] 00019
3 wpa_printf [function] [call site] 00020
3 sae_set_group [function] [call site] 00021
4 dragonfly_suitable_group [function] [call site] 00022
4 wpa_printf [function] [call site] 00023
4 sae_clear_data [function] [call site] 00024
5 sae_clear_temp_data [function] [call site] 00025
6 crypto_ec_deinit [function] [call site] 00026
7 BN_clear_free [call site] 00027
7 BN_clear_free [call site] 00028
7 BN_clear_free [call site] 00029
7 BN_clear_free [call site] 00030
7 EC_GROUP_free [call site] 00031
7 BN_CTX_free [call site] 00032
6 crypto_bignum_deinit [function] [call site] 00033
7 BN_clear_free [call site] 00034
7 BN_free [call site] 00035
6 crypto_bignum_deinit [function] [call site] 00036
6 crypto_bignum_deinit [function] [call site] 00037
6 crypto_bignum_deinit [function] [call site] 00038
6 crypto_bignum_deinit [function] [call site] 00039
6 crypto_bignum_deinit [function] [call site] 00040
6 crypto_bignum_deinit [function] [call site] 00041
6 crypto_ec_point_deinit [function] [call site] 00042
7 EC_POINT_clear_free [call site] 00043
7 EC_POINT_free [call site] 00044
6 crypto_ec_point_deinit [function] [call site] 00045
6 crypto_ec_point_deinit [function] [call site] 00046
6 wpabuf_free [function] [call site] 00047
6 wpabuf_free [function] [call site] 00048
6 wpabuf_free [function] [call site] 00049
6 bin_clear_free [function] [call site] 00050
7 forced_memzero [function] [call site] 00051
5 crypto_bignum_deinit [function] [call site] 00052
5 crypto_bignum_deinit [function] [call site] 00053
4 os_zalloc [function] [call site] 00054
5 calloc [call site] 00055
4 crypto_ec_init [function] [call site] 00056
5 crypto_ec_group_2_nid [function] [call site] 00057
5 os_zalloc [function] [call site] 00058
5 BN_CTX_new [call site] 00059
5 EC_GROUP_new_by_curve_name [call site] 00060
5 BN_new [call site] 00061
5 BN_new [call site] 00062
5 BN_new [call site] 00063
5 BN_new [call site] 00064
5 EC_GROUP_get_curve [call site] 00065
5 EC_GROUP_get_order [call site] 00066
5 crypto_ec_deinit [function] [call site] 00067
4 wpa_printf [function] [call site] 00068
4 crypto_ec_prime_len [function] [call site] 00069
5 BN_num_bits [call site] 00070
4 crypto_ec_get_prime [function] [call site] 00071
4 crypto_ec_order_len [function] [call site] 00072
5 BN_num_bits [call site] 00073
4 crypto_ec_get_order [function] [call site] 00074
4 dh_groups_get [function] [call site] 00075
4 wpa_printf [function] [call site] 00076
4 sae_clear_data [function] [call site] 00077
4 crypto_bignum_init_set [function] [call site] 00078
5 BN_bin2bn [call site] 00079
4 sae_clear_data [function] [call site] 00080
4 crypto_bignum_init_set [function] [call site] 00081
4 sae_clear_data [function] [call site] 00082
4 wpa_printf [function] [call site] 00083
3 wpa_printf [function] [call site] 00084
3 wpa_printf [function] [call site] 00085
3 wpa_printf [function] [call site] 00086
2 sae_parse_commit_token [function] [call site] 00087
3 wpa_printf [function] [call site] 00088
3 wpa_hexdump [function] [call site] 00089
4 _wpa_hexdump [function] [call site] 00090
5 wpa_debug_print_timestamp [function] [call site] 00091
5 fprintf [call site] 00092
5 fprintf [call site] 00093
5 fprintf [call site] 00094
5 fprintf [call site] 00095
5 fprintf [call site] 00096
5 printf [call site] 00097
5 printf [call site] 00098
5 printf [call site] 00099
5 printf [call site] 00100
2 sae_parse_commit_scalar [function] [call site] 00101
3 wpa_printf [function] [call site] 00102
3 crypto_bignum_init_set [function] [call site] 00103
3 crypto_bignum_cmp [function] [call site] 00104
4 BN_cmp [call site] 00105
3 wpa_printf [function] [call site] 00106
3 crypto_bignum_deinit [function] [call site] 00107
3 crypto_bignum_is_zero [function] [call site] 00108
4 BN_is_zero [call site] 00109
3 crypto_bignum_is_one [function] [call site] 00110
4 BN_is_one [call site] 00111
3 crypto_bignum_cmp [function] [call site] 00112
3 wpa_printf [function] [call site] 00113
3 crypto_bignum_deinit [function] [call site] 00114
3 crypto_bignum_deinit [function] [call site] 00115
3 wpa_hexdump [function] [call site] 00116
2 sae_parse_commit_element [function] [call site] 00117
3 sae_parse_commit_element_ffc [function] [call site] 00118
4 wpa_printf [function] [call site] 00119
4 wpa_hexdump [function] [call site] 00120
4 crypto_bignum_deinit [function] [call site] 00121
4 crypto_bignum_init_set [function] [call site] 00122
4 crypto_bignum_init [function] [call site] 00123
5 BN_new [call site] 00124
4 crypto_bignum_init_set [function] [call site] 00125
4 crypto_bignum_sub [function] [call site] 00126
5 BN_sub [call site] 00127
4 crypto_bignum_is_zero [function] [call site] 00128
4 crypto_bignum_is_one [function] [call site] 00129
4 crypto_bignum_cmp [function] [call site] 00130
4 crypto_bignum_deinit [function] [call site] 00131
4 crypto_bignum_deinit [function] [call site] 00132
4 wpa_printf [function] [call site] 00133
4 crypto_bignum_deinit [function] [call site] 00134
4 crypto_bignum_exptmod [function] [call site] 00135
5 BN_CTX_new [call site] 00136
5 BN_mod_exp_mont_consttime [call site] 00137
5 BN_CTX_free [call site] 00138
4 crypto_bignum_is_one [function] [call site] 00139
4 wpa_printf [function] [call site] 00140
4 crypto_bignum_deinit [function] [call site] 00141
4 crypto_bignum_deinit [function] [call site] 00142
3 sae_parse_commit_element_ecc [function] [call site] 00143
4 wpa_printf [function] [call site] 00144
4 crypto_bignum_to_bin [function] [call site] 00145
5 BN_bn2binpad [call site] 00146
5 BN_num_bits [call site] 00147
5 BN_bn2bin [call site] 00148
4 memcmp [call site] 00149
4 memcmp [call site] 00150
4 wpa_printf [function] [call site] 00151
4 wpa_hexdump [function] [call site] 00152
4 wpa_hexdump [function] [call site] 00153
4 crypto_ec_point_deinit [function] [call site] 00154
4 crypto_ec_point_from_bin [function] [call site] 00155
5 BN_num_bits [call site] 00156
5 BN_bin2bn [call site] 00157
5 BN_bin2bn [call site] 00158
5 EC_POINT_new [call site] 00159
5 BN_clear_free [call site] 00160
5 BN_clear_free [call site] 00161
5 EC_POINT_clear_free [call site] 00162
5 EC_POINT_set_affine_coordinates [call site] 00163
5 EC_POINT_clear_free [call site] 00164
5 BN_clear_free [call site] 00165
5 BN_clear_free [call site] 00166
4 wpa_printf [function] [call site] 00167
4 crypto_ec_point_is_on_curve [function] [call site] 00168
5 EC_POINT_is_on_curve [call site] 00169
4 wpa_printf [function] [call site] 00170
2 sae_parse_password_identifier [function] [call site] 00171
3 wpa_hexdump [function] [call site] 00172
3 sae_is_password_id_elem [function] [call site] 00173
3 wpa_printf [function] [call site] 00174
3 strlen [call site] 00175
3 memcmp [call site] 00176
3 wpa_printf [function] [call site] 00177
3 wpa_hexdump_ascii [function] [call site] 00178
4 _wpa_hexdump_ascii [function] [call site] 00179
5 wpa_debug_print_timestamp [function] [call site] 00180
5 fprintf [call site] 00181
5 fprintf [call site] 00182
5 fprintf [call site] 00183
5 fprintf [call site] 00184
5 fprintf [call site] 00185
5 fprintf [call site] 00186
5 fprintf [call site] 00187
5 __ctype_b_loc [call site] 00188
5 fprintf [call site] 00189
5 fprintf [call site] 00190
5 fprintf [call site] 00191
5 fprintf [call site] 00192
5 printf [call site] 00193
5 printf [call site] 00194
5 printf [call site] 00195
5 printf [call site] 00196
5 printf [call site] 00197
5 printf [call site] 00198
5 printf [call site] 00199
5 __ctype_b_loc [call site] 00200
5 printf [call site] 00201
5 printf [call site] 00202
5 printf [call site] 00203
5 printf [call site] 00204
2 sae_parse_rejected_groups [function] [call site] 00205
3 wpa_hexdump [function] [call site] 00206
3 sae_is_rejected_groups_elem [function] [call site] 00207
3 wpabuf_free [function] [call site] 00208
3 wpabuf_alloc [function] [call site] 00209
4 os_zalloc [function] [call site] 00210
3 wpabuf_put_data [function] [call site] 00211
4 wpabuf_put [function] [call site] 00212
5 wpabuf_mhead_u8 [function] [call site] 00213
6 wpabuf_mhead [function] [call site] 00214
5 wpabuf_overflow [function] [call site] 00215
6 wpa_printf [function] [call site] 00216
6 abort [call site] 00217
3 wpa_hexdump_buf [function] [call site] 00218
4 wpabuf_head [function] [call site] 00219
4 wpabuf_len [function] [call site] 00220
4 wpa_hexdump [function] [call site] 00221
2 sae_parse_token_container [function] [call site] 00222
3 wpa_hexdump [function] [call site] 00223
3 sae_is_token_container_elem [function] [call site] 00224
3 wpa_hexdump [function] [call site] 00225
2 sae_parse_akm_suite_selector [function] [call site] 00226
3 wpa_hexdump [function] [call site] 00227
3 sae_is_akm_suite_selector_elem [function] [call site] 00228
3 WPA_GET_BE32 [function] [call site] 00229
3 wpa_printf [function] [call site] 00230
2 wpa_printf [function] [call site] 00231
2 crypto_bignum_cmp [function] [call site] 00232
2 crypto_bignum_cmp [function] [call site] 00233
2 crypto_ec_point_cmp [function] [call site] 00234
3 EC_POINT_cmp [call site] 00235
1 wpa_printf [function] [call site] 00236
1 sae_clear_data [function] [call site] 00237
1 sae_parse_commit [function] [call site] 00238
1 wpa_printf [function] [call site] 00239
1 sae_clear_data [function] [call site] 00240
1 os_program_deinit [function] [call site] 00241