High level conclusions

Fuzzers reach 66.10% of cyclomatic complexity.

Fuzzers reach 61.93% of all functions.

Fuzzer wnm is blocked:

The runtime code coverage of wnm covers 6.019% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ap-mgmt is blocked:

The runtime code coverage of ap-mgmt covers 11.14% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dpp-uri is blocked:

The runtime code coverage of dpp-uri covers 10.01% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer tls-server is blocked:

The runtime code coverage of tls-server covers 29.65% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3121/5039

Cyclomatic complexity statically reachable by fuzzers

23713/35870

Runtime code coverage of functions

1098 / 5039

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	29	34.1%
gold	[1:9]	7	8.23%
yellow	[10:29]	7	8.23%
greenyellow	[30:49]	1	1.17%
lawngreen	50+	41	48.2%
All colors	85	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00067	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00039	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	0	None	0	0	asn1_get_next	call site: 00005	/src/hostap/tests/fuzzing/asn1/../../../src/tls/asn1.c:180
0	0	None	0	0	asn1_oid_to_str	call site: 00057	/src/hostap/tests/fuzzing/asn1/../../../src/tls/asn1.c:357
0	0	None	0	0	asn1_parse	call site: 00033	/src/hostap/tests/fuzzing/asn1/asn1.c:86
0	0	None	0	0	asn1_parse	call site: 00033	/src/hostap/tests/fuzzing/asn1/asn1.c:111

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

9

Reachable functions

28

Percentage of reachable functions covered

67.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/asn1/asn1.c	3
tests/fuzzing/asn1/../fuzzer-common.c	1
tests/fuzzing/asn1/../../../src/tls/asn1.c	8
tests/fuzzing/asn1/../../../src/utils/wpa_debug.c	6
tests/fuzzing/asn1/../../../src/utils/os_unix.c	1
tests/fuzzing/asn1/../../../src/tls/asn1.h	1
tests/fuzzing/asn1/../../../src/utils/os.h	1

Fuzzer: json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	9.85%
gold	[1:9]	5	7.04%
yellow	[10:29]	5	7.04%
greenyellow	[30:49]	4	5.63%
lawngreen	50+	50	70.4%
All colors	71	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	0	None	6	258	json_parse	call site: 00005	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:238
0	0	None	6	258	json_parse	call site: 00032	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:303
0	0	None	6	258	json_parse	call site: 00041	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:375
0	0	None	6	258	json_parse	call site: 00047	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:427
0	0	None	2	17	json_parse_string	call site: 00023	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:76
0	0	None	2	17	json_parse_string	call site: 00024	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:91
0	0	None	2	2	json_parse_number	call site: 00045	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:179
0	0	None	0	6	json_parse	call site: 00045	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:423
0	0	None	0	0	json_parse_number	call site: 00045	/src/hostap/tests/fuzzing/json/../../../src/utils/json.c:175

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

12

Reachable functions

29

Percentage of reachable functions covered

58.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/json/json.c	1
tests/fuzzing/json/../fuzzer-common.c	1
tests/fuzzing/json/../../../src/utils/json.c	9
tests/fuzzing/json/../../../src/utils/wpa_debug.c	2
tests/fuzzing/json/../../../src/utils/os_unix.c	2
tests/fuzzing/json/../../../src/utils/common.c	3
tests/fuzzing/json/../../../src/utils/os.h	1

Fuzzer: eap-mschapv2-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	139	40.5%
gold	[1:9]	1	0.29%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	203	59.1%
All colors	343	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
70	70	2 : View List ['wpabuf_put_be24', 'wpabuf_put_be32']	70	70	eap_msg_alloc	call site: 00118	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_common/eap_common.c:146
54	104	2 : View List ['generate_nt_response_pwhash', 'generate_authenticator_response_pwhash']	54	291	mschapv2_derive_response	call site: 00154	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/mschapv2.c:63
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00079	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00141	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
4	16	2 : View List ['eap_mschapv2_deinit', 'os_memdup']	4	16	eap_mschapv2_init	call site: 00021	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c:126
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	4	1 : View List ['wpabuf_free']	0	4	eap_mschapv2_challenge_reply	call site: 00136	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c:211
0	2	1 : View List ['eap_sm_request_identity']	0	2	eap_mschapv2_check_config	call site: 00031	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c:718
0	2	1 : View List ['eap_sm_request_password']	0	2	eap_mschapv2_check_config	call site: 00035	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c:724
0	0	None	8	32	eap_mschapv2_init	call site: 00010	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c:117
0	0	None	0	206	eap_mschapv2_challenge_reply	call site: 00131	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c:196
0	0	None	0	206	eap_mschapv2_challenge_reply	call site: 00134	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c:206

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

37

Reachable functions

126

Percentage of reachable functions covered

70.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-mschapv2-peer/eap-mschapv2-peer.c	11
tests/fuzzing/eap-mschapv2-peer/../fuzzer-common.c	1
tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c	16
src/utils/os_unix.c	5
src/utils/wpa_debug.c	9
src/utils/wpabuf.c	6
src/utils/common.c	6
tests/fuzzing/eap-mschapv2-peer/../../../src/eap_common/eap_common.c	4
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpabuf.h	6
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/common.h	6
src/utils/../utils/wpabuf.h	5
tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/mschapv2.c	3
src/crypto/ms_funcs.c	15
src/crypto/sha1-internal.c	5
src/crypto/des-internal.c	4
src/crypto/../utils/common.h	3
src/crypto/md4-internal.c	6
src/utils/../utils/os.h	1
src/crypto/rc4.c	1
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpa_debug.h	1

Fuzzer: eap-sim-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	109	21.1%
gold	[1:9]	1	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	406	78.6%
All colors	516	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
98	98	2 : View List ['eap_sim_ext_sim_req', 'eap_sim_ext_sim_result']	98	98	eap_sim_gsm_auth	call site: 00259	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c:282
97	97	1 : View List ['eap_sim_process_notification_reauth']	97	97	eap_sim_process_notification_auth	call site: 00380	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c:1010
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00000	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00039	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
7	256	4 : View List ['eap_sim_msg_add_encr_end', 'eap_sim_msg_add', 'eap_sim_msg_free', 'eap_sim_msg_add_encr_start']	7	398	eap_sim_response_notification	call site: 00400	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c:719
7	7	1 : View List ['eap_sim_msg_free']	7	7	eap_sim_response_reauth	call site: 00456	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c:693
4	4	1 : View List ['realloc']	4	4	wpabuf_resize	call site: 00160	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpabuf.c:69
2	2	1 : View List ['eap_sm_request_identity']	2	2	eap_sim_process	call site: 00051	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c:1204
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	73	1 : View List ['eap_sim_msg_add_mac']	0	142	eap_sim_response_notification	call site: 00426	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c:735
0	66	1 : View List ['eap_sim_msg_add']	0	208	eap_sim_response_reauth	call site: 00458	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c:699
0	46	2 : View List ['WPA_GET_BE16', 'wpa_hexdump']	0	46	eap_sim_parse_attr	call site: 00130	/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_common/eap_sim_common.c:795

Runtime coverage analysis

Covered functions

96

Functions that are reachable but not covered

39

Reachable functions

135

Percentage of reachable functions covered

71.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-sim-peer/eap-sim-peer.c	8
tests/fuzzing/eap-sim-peer/../fuzzer-common.c	1
tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c	33
src/utils/os_unix.c	5
src/utils/wpa_debug.c	6
tests/fuzzing/eap-sim-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-sim-peer/../../../src/utils/wpabuf.h	8
tests/fuzzing/eap-sim-peer/../../../src/eap_common/eap_common.c	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
tests/fuzzing/eap-sim-peer/../../../src/utils/common.h	4
tests/fuzzing/eap-sim-peer/../../../src/eap_common/eap_sim_common.c	18
src/utils/wpabuf.c	6
src/utils/../utils/wpabuf.h	3
src/crypto/sha1.c	1
src/crypto/sha1-internal.c	5
src/utils/common.c	6
src/utils/../utils/os.h	1
src/crypto/milenage.c	2
src/crypto/aes-encblock.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/fips_prf_internal.c	1
src/crypto/aes-cbc.c	1

Fuzzer: eap-aka-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	165	28.9%
gold	[1:9]	1	0.17%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	404	70.8%
All colors	570	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
463	642	8 : View List ['eap_aka_clear_identities', 'eap_sim_derive_keys_reauth', 'eap_aka_prime_derive_keys_reauth', 'eap_aka_learn_ids', 'wpa_hexdump', 'eap_aka_state', 'free', 'eap_aka_response_reauth']	463	775	eap_aka_process_reauthentication	call site: 00494	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:1383
190	256	4 : View List ['eap_sim_msg_add_encr_end', 'eap_sim_msg_add', 'eap_sim_msg_free', 'eap_sim_msg_add_encr_start']	190	398	eap_aka_response_notification	call site: 00449	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:843
101	101	2 : View List ['eap_aka_ext_sim_result', 'eap_aka_ext_sim_req']	101	101	eap_aka_umts_auth	call site: 00251	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:285
97	97	1 : View List ['eap_aka_process_notification_reauth']	97	97	eap_aka_process_notification_auth	call site: 00429	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:1274
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00000	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00035	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
2	2	1 : View List ['eap_aka_prime_derive_keys']	2	561	eap_aka_process_challenge	call site: 00345	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:1171
2	2	1 : View List ['eap_sm_request_identity']	2	2	eap_aka_process	call site: 00047	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:1476
2	2	1 : View List ['eap_sim_verify_mac_sha256']	2	2	eap_aka_verify_mac	call site: 00366	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:927
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	137	2 : View List ['wpabuf_free', 'eap_aka_client_error']	0	137	eap_aka_process_identity	call site: 00224	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:908
0	73	1 : View List ['eap_sim_msg_add_mac']	0	142	eap_aka_response_notification	call site: 00476	/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c:859

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

48

Reachable functions

147

Percentage of reachable functions covered

67.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-aka-peer/eap-aka-peer.c	9
tests/fuzzing/eap-aka-peer/../fuzzer-common.c	1
tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c	38
src/utils/os_unix.c	5
src/utils/wpa_debug.c	6
src/utils/wpabuf.c	6
tests/fuzzing/eap-aka-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-aka-peer/../../../src/utils/wpabuf.h	9
tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_common.c	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
tests/fuzzing/eap-aka-peer/../../../src/utils/common.h	4
tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_sim_common.c	19
src/utils/../utils/wpabuf.h	3
src/crypto/sha1.c	1
src/crypto/sha1-internal.c	5
src/utils/common.c	6
src/utils/../utils/os.h	1
src/crypto/milenage.c	3
src/crypto/aes-encblock.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_sim_common.h	3
src/crypto/fips_prf_internal.c	1
src/crypto/aes-cbc.c	1

Fuzzer: x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	15.4%
gold	[1:9]	26	7.44%
yellow	[10:29]	19	5.44%
greenyellow	[30:49]	17	4.87%
lawngreen	50+	233	66.7%
All colors	349	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00104	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00045	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	29	1 : View List ['x509_certificate_free']	0	29	x509_certificate_parse	call site: 00344	/src/hostap/src/tls/x509v3.c:1807
0	0	None	0	835	x509_parse_tbs_certificate	call site: 00184	/src/hostap/src/tls/x509v3.c:1557
0	0	None	0	29	x509_certificate_parse	call site: 00039	/src/hostap/src/tls/x509v3.c:1754
0	0	None	0	6	x509_certificate_free	call site: 00039	/src/hostap/src/tls/x509v3.c:49
0	0	None	0	3	x509_parse_name	call site: 00100	/src/hostap/src/tls/x509v3.c:408
0	0	None	0	3	x509_parse_name	call site: 00132	/src/hostap/src/tls/x509v3.c:440
0	0	None	0	0	asn1_oid_to_str	call site: 00224	/src/hostap/tests/fuzzing/asn1/../../../src/tls/asn1.c:357
0	0	None	0	0	x509_parse_algorithm_identifier	call site: 00076	/src/hostap/src/tls/x509v3.c:200
0	0	None	0	0	x509_parse_name	call site: 00086	/src/hostap/src/tls/x509v3.c:312

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

17

Reachable functions

91

Percentage of reachable functions covered

81.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/x509/x509.c	1
tests/fuzzing/x509/../fuzzer-common.c	1
src/tls/x509v3.c	40
src/utils/os_unix.c	5
src/tls/asn1.c	10
src/utils/wpa_debug.c	6
src/tls/./asn1.h	10
src/utils/common.c	1
src/tls/../utils/os.h	1

Fuzzer: sae

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	101	41.7%
gold	[1:9]	3	1.23%
yellow	[10:29]	2	0.82%
greenyellow	[30:49]	1	0.41%
lawngreen	50+	135	55.7%
All colors	242	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
84	84	1 : View List ['sae_parse_commit_element_ffc']	84	84	sae_parse_commit_element	call site: 00117	/src/hostap/src/common/sae.c:2042
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00179	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00090	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
4	4	2 : View List ['BN_num_bits', 'BN_bn2bin']	4	4	crypto_bignum_to_bin	call site: 00145	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:1937
3	125	3 : View List ['crypto_bignum_init_set', 'dh_groups_get', 'sae_clear_data']	3	125	sae_set_group	call site: 00056	/src/hostap/src/common/sae.c:46
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	0	None	6	6	crypto_ec_point_from_bin	call site: 00159	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2483
0	0	None	4	233	sae_parse_commit	call site: 00117	/src/hostap/src/common/sae.c:2186
0	0	None	3	226	sae_set_group	call site: 00022	/src/hostap/src/common/sae.c:33
0	0	None	0	34	sae_parse_rejected_groups	call site: 00209	/src/hostap/src/common/sae.c:2119
0	0	None	0	29	sae_parse_password_identifier	call site: 00177	/src/hostap/src/common/sae.c:2087
0	0	None	0	7	sae_parse_commit_scalar	call site: 00103	/src/hostap/src/common/sae.c:1911

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

46

Reachable functions

104

Percentage of reachable functions covered

55.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/sae/sae.c	1
tests/fuzzing/sae/../fuzzer-common.c	1
src/utils/os_unix.c	5
src/common/sae.c	18
src/common/../utils/common.h	2
src/utils/wpa_debug.c	6
tests/fuzzing/sae/../../../src/common/dragonfly.c	1
tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c	20
src/utils/wpabuf.c	4
src/utils/common.c	2
tests/fuzzing/sae/../../../src/crypto/dh_groups.c	1
src/common/../utils/wpabuf.h	3
src/utils/../utils/wpabuf.h	2
src/common/../utils/wpa_debug.h	1

Fuzzer: tls-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	662	38.0%
gold	[1:9]	86	4.94%
yellow	[10:29]	81	4.65%
greenyellow	[30:49]	48	2.76%
lawngreen	50+	862	49.5%
All colors	1739	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1408	1408	1 : View List ['tls_process_certificate_status']	1408	1408	tls_process_server_key_exchange	call site: 00409	/src/hostap/src/tls/tlsv1_client_read.c:1063
369	393	5 : View List ['bignum_sub', 'bignum_mulmod', 'bignum_init', 'bignum_add', 'bignum_mul']	369	1130	crypto_rsa_exptmod	call site: 00890	/src/hostap/src/tls/rsa.c:277
234	280	6 : View List ['wpabuf_alloc', 'wpabuf_mhead', 'tlsv1_server_decrypt', 'wpabuf_size', 'wpabuf_free', 'wpabuf_put']	234	280	tls_connection_decrypt2	call site: 01664	/src/hostap/src/crypto/tls_internal.c:616
220	220	1 : View List ['tlsv1_server_deinit']	220	220	tls_connection_deinit	call site: 01712	/src/hostap/src/crypto/tls_internal.c:159
209	209	1 : View List ['tlsv1_server_encrypt']	209	255	tls_connection_encrypt	call site: 01630	/src/hostap/src/crypto/tls_internal.c:558
140	140	2 : View List ['tlsv1_server_init', 'free']	140	140	tls_connection_init	call site: 00112	/src/hostap/src/crypto/tls_internal.c:115
82	82	2 : View List ['x509_certificate_get_subject', 'x509_certificate_self_signed']	82	82	tls_client_cert_chain_der_len	call site: 01469	/src/hostap/src/tls/tlsv1_client_write.c:29
39	39	1 : View List ['mp_reduce_2k_setup_l']	39	392	s_mp_exptmod	call site: 00904	/src/hostap/src/tls/./libtommath.c:1936
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00573	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
12	76	3 : View List ['crypto_private_key_free', 'x509_certificate_chain_free', 'free']	12	76	tlsv1_cred_free	call site: 01719	/src/hostap/src/tls/tlsv1_cred.c:31
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00132	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
4	4	1 : View List ['realloc']	4	4	wpabuf_resize	call site: 00216	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpabuf.c:69

Runtime coverage analysis

Covered functions

295

Functions that are reachable but not covered

89

Reachable functions

383

Percentage of reachable functions covered

76.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/tls-client/tls-client.c	2
tests/fuzzing/tls-client/../fuzzer-common.c	1
src/crypto/tls_internal.c	11
src/tls/tlsv1_client.c	13
src/crypto/crypto_internal.c	5
src/tls/tlsv1_server.c	11
src/utils/os_unix.c	7
src/tls/tlsv1_common.c	13
src/crypto/md5-internal.c	5
src/utils/common.c	4
src/crypto/sha1-internal.c	5
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/sha384-internal.c	4
src/crypto/sha512-internal.c	5
src/utils/wpa_debug.c	7
src/crypto/../utils/wpabuf.h	4
src/tls/tlsv1_client_write.c	13
src/tls/../utils/common.h	5
src/tls/tlsv1_record.c	5
src/crypto/crypto_internal-cipher.c	4
src/crypto/rc4.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/./aes_i.h	1
src/crypto/des-internal.c	9
src/utils/wpabuf.c	7
src/tls/../utils/wpabuf.h	4
src/utils/../utils/wpabuf.h	3
src/crypto/aes-internal-dec.c	5
src/tls/tlsv1_client_read.c	17
src/crypto/sha256-tlsprf.c	1
src/crypto/sha256.c	2
src/crypto/sha1-tlsprf.c	1
src/crypto/md5.c	2
src/crypto/sha1.c	2
src/tls/tlsv1_client_ocsp.c	7
src/tls/asn1.c	10
src/tls/./asn1.h	13
src/tls/../utils/os.h	1
src/tls/x509v3.c	59
src/crypto/crypto_internal-rsa.c	7
src/tls/rsa.c	5
src/tls/bignum.c	11
src/tls/./libtommath.c	45
src/tls/pkcs1.c	3
src/crypto/aes-internal.c	1
src/crypto/crypto_internal-modexp.c	1
tests/fuzzing/tls-client/../../../src/utils/common.h	1
tests/fuzzing/tls-client/../../../src/utils/wpabuf.h	4
tests/fuzzing/tls-client/../../../src/utils/wpa_debug.h	1
src/tls/tlsv1_cred.c	1

Fuzzer: tls-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1506	82.5%
gold	[1:9]	269	14.7%
yellow	[10:29]	23	1.26%
greenyellow	[30:49]	16	0.87%
lawngreen	50+	11	0.60%
All colors	1825	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
602	602	1 : View List ['tlsv1_set_key_enc_pem']	602	602	tlsv1_set_key	call site: 00703	/src/hostap/src/tls/tlsv1_cred.c:1012
567	567	1 : View List ['pkcs8_enc_key_import']	567	771	crypto_private_key_import	call site: 00436	/src/hostap/src/crypto/crypto_internal-rsa.c:49
239	239	1 : View List ['tlsv1_client_deinit']	239	459	tls_connection_deinit	call site: 01807	/src/hostap/src/crypto/tls_internal.c:155
74	78	5 : View List ['WPA_GET_BE16', 'wpabuf_alloc', 'wpabuf_put_data', 'wpabuf_free', 'wpa_hexdump_buf']	74	78	read_msg	call site: 00841	/src/hostap/tests/fuzzing/tls-client/tls-client.c:31
56	56	1 : View List ['crypto_cipher_init']	56	56	tlsv1_record_change_write_cipher	call site: 01581	/src/hostap/src/tls/tlsv1_record.c:86
56	56	1 : View List ['crypto_cipher_init']	56	56	tlsv1_record_change_read_cipher	call site: 01429	/src/hostap/src/tls/tlsv1_record.c:120
14	14	1 : View List ['mp_copy']	28	39	mp_mul_2d	call site: 00451	/src/hostap/src/tls/./libtommath.c:1390
14	14	1 : View List ['mp_lshd']	14	18	mp_mul_2d	call site: 00454	/src/hostap/src/tls/./libtommath.c:1403
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00148	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
12	12	1 : View List ['crypto_cipher_deinit']	68	68	tlsv1_record_change_write_cipher	call site: 01580	/src/hostap/src/tls/tlsv1_record.c:82
12	12	1 : View List ['crypto_cipher_deinit']	68	68	tlsv1_record_change_read_cipher	call site: 01428	/src/hostap/src/tls/tlsv1_record.c:116
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00089	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

287

Reachable functions

408

Percentage of reachable functions covered

29.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/tls-server/tls-server.c	2
tests/fuzzing/tls-server/../fuzzer-common.c	1
src/crypto/tls_internal.c	11
src/tls/tlsv1_client.c	10
src/crypto/crypto_internal.c	5
src/tls/tlsv1_server.c	12
src/utils/os_unix.c	8
src/tls/tlsv1_cred.c	15
src/tls/x509v3.c	58
src/utils/wpa_debug.c	8
src/crypto/crypto_internal-rsa.c	8
src/tls/rsa.c	6
src/tls/bignum.c	12
src/tls/./libtommath.c	45
src/utils/common.c	7
src/tls/asn1.c	10
src/tls/./asn1.h	11
src/tls/../utils/os.h	1
src/utils/base64.c	2
src/tls/pkcs8.c	2
src/tls/pkcs5.c	13
src/tls/../utils/common.h	6
src/crypto/sha1-pbkdf2.c	2
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/crypto/crypto_internal-cipher.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/aes-internal-dec.c	5
src/crypto/./aes_i.h	1
src/crypto/des-internal.c	9
src/crypto/md5-internal.c	5
src/crypto/rc4.c	1
src/crypto/../utils/common.h	4
src/tls/tlsv1_common.c	12
src/crypto/sha256-internal.c	5
src/crypto/sha384-internal.c	4
src/crypto/sha512-internal.c	5
tests/fuzzing/tls-server/../../../src/utils/common.h	1
src/utils/wpabuf.c	7
tests/fuzzing/tls-server/../../../src/utils/wpabuf.h	4
src/utils/../utils/wpabuf.h	3
tests/fuzzing/tls-server/../../../src/utils/wpa_debug.h	1
src/crypto/../utils/wpabuf.h	4
src/tls/tlsv1_record.c	5
src/tls/tlsv1_server_read.c	12
src/crypto/crypto_internal-modexp.c	1
src/crypto/sha256-tlsprf.c	1
src/crypto/sha256.c	2
src/crypto/sha1-tlsprf.c	1
src/crypto/md5.c	2
src/tls/pkcs1.c	4
src/tls/tlsv1_server_write.c	13
src/tls/../utils/wpabuf.h	4

Fuzzer: pasn-init

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	755	67.9%
gold	[1:9]	23	2.07%
yellow	[10:29]	15	1.35%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	316	28.4%
All colors	1111	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
948	948	5 : View List ['pmksa_cache_get', 'wpas_pasn_wd_fils_rx', 'wpas_pasn_wd_sae_rx', 'wpa_key_mgmt_ft.1573', 'pmksa_cache_add']	948	948	wpas_pasn_set_pmk	call site: 00733	/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/pasn_initiator.c:757
71	71	1 : View List ['wpa_ltf_keyseed']	658	894	wpa_pasn_auth_rx	call site: 01028	/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/pasn_initiator.c:1229
67	67	2 : View List ['wpa_parse_wpa_ie_wpa', 'WPA_GET_BE32.1446']	67	180	wpa_parse_wpa_ie	call site: 00584	/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c:31
42	42	1 : View List ['sha384_vector']	42	42	pasn_auth_frame_hash	call site: 00510	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c:1596
35	35	1 : View List ['sha384_prf']	35	170	pasn_pmk_to_ptk	call site: 01014	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c:1386
21	21	1 : View List ['hmac_sha384']	21	48	pasn_mic	call site: 01053	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c:1558
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00192	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
4	8	3 : View List ['wpabuf_free', 'ERR_get_error', 'ERR_error_string']	16	20	crypto_ecdh_set_peerkey	call site: 00707	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2943
4	4	2 : View List ['ERR_get_error', 'ERR_error_string']	10	14	crypto_ecdh_get_pubkey	call site: 00091	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2798
4	4	2 : View List ['BN_num_bits', 'BN_bn2bin']	4	4	crypto_bignum_to_bin	call site: 00095	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:1937
2	2	1 : View List ['BN_new']	14	111	crypto_ecdh_get_pubkey	call site: 00088	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2789
2	2	1 : View List ['BN_clear_free']	2	2	crypto_bignum_deinit	call site: 00130	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:1919

Runtime coverage analysis

Covered functions

101

Functions that are reachable but not covered

187

Reachable functions

288

Percentage of reachable functions covered

35.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/pasn-init/pasn-init.c	2
tests/fuzzing/pasn-init/../fuzzer-common.c	1
tests/fuzzing/pasn-init/../../../src/utils/os_unix.c	7
tests/fuzzing/pasn-init/../../../src/utils/common.c	7
tests/fuzzing/pasn-init/../../../src/pasn/pasn_initiator.c	16
tests/fuzzing/pasn-init/../../../src/common/dragonfly.c	3
tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.c	7
tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c	10
tests/fuzzing/pasn-init/../../../src/crypto/crypto_openssl.c	45
tests/fuzzing/pasn-init/../../../src/utils/wpabuf.c	7
tests/fuzzing/pasn-init/../../../src/utils/wpabuf.h	11
tests/fuzzing/pasn-init/../../../src/common/wpa_common.c	29
tests/fuzzing/pasn-init/../../../src/common/defs.h	4
tests/fuzzing/pasn-init/../../../src/rsn_supp/pmksa_cache.h	2
tests/fuzzing/pasn-init/../../../src/common/sae.c	41
tests/fuzzing/pasn-init/../../../src/crypto/dh_groups.c	1
tests/fuzzing/pasn-init/../../../src/utils/common.h	5
tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.h	1
tests/fuzzing/pasn-init/../../../src/eapol_supp/eapol_supp_sm.h	4
tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.h	1
tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c	1
tests/fuzzing/pasn-init/../../../src/crypto/sha256-prf.c	2
tests/fuzzing/pasn-init/../../../src/crypto/sha384-prf.c	2

Fuzzer: pasn-resp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	667	65.2%
gold	[1:9]	28	2.73%
yellow	[10:29]	21	2.05%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	307	30.0%
All colors	1023	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
660	660	1 : View List ['pasn_wd_handle_sae_commit']	662	1282	handle_auth_pasn_1	call site: 00311	/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c:758
134	134	2 : View List ['pasn_wd_handle_sae_confirm', 'free']	134	142	handle_auth_pasn_3	call site: 00986	/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c:984
71	71	1 : View List ['wpa_ltf_keyseed']	71	71	pasn_derive_keys	call site: 00740	/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c:347
42	42	1 : View List ['sha384_vector']	42	42	pasn_auth_frame_hash	call site: 00685	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c:1596
35	35	1 : View List ['sha384_prf']	35	170	pasn_pmk_to_ptk	call site: 00726	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c:1386
21	21	1 : View List ['hmac_sha384']	21	48	pasn_mic	call site: 00946	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c:1558
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00047	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
4	8	3 : View List ['wpabuf_free', 'ERR_get_error', 'ERR_error_string']	16	20	crypto_ecdh_set_peerkey	call site: 00283	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2943
4	4	2 : View List ['ERR_get_error', 'ERR_error_string']	10	14	crypto_ecdh_get_pubkey	call site: 00888	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2798
4	4	2 : View List ['BN_num_bits', 'BN_bn2bin']	4	4	crypto_bignum_to_bin	call site: 00381	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:1937
2	2	1 : View List ['BN_new']	14	111	crypto_ecdh_get_pubkey	call site: 00885	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:2789
2	2	1 : View List ['clock_gettime']	2	2	os_get_reltime	call site: 00171	/src/hostap/tests/fuzzing/asn1/../../../src/utils/os_unix.c:94

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

185

Reachable functions

284

Percentage of reachable functions covered

34.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/pasn-resp/pasn-resp.c	4
tests/fuzzing/pasn-resp/../fuzzer-common.c	1
tests/fuzzing/pasn-resp/../../../src/utils/os_unix.c	8
tests/fuzzing/pasn-resp/../../../src/utils/eloop.c	4
tests/fuzzing/pasn-resp/../../../src/utils/list.h	2
tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.c	7
tests/fuzzing/pasn-resp/../../../src/utils/common.c	4
tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c	10
tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.c	9
tests/fuzzing/pasn-resp/../../../src/utils/common.h	7
tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.h	1
tests/fuzzing/pasn-resp/../../../src/common/wpa_common.c	23
tests/fuzzing/pasn-resp/../../../src/ap/comeback_token.c	3
tests/fuzzing/pasn-resp/../../../src/crypto/crypto_openssl.c	44
tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.c	7
tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.h	11
tests/fuzzing/pasn-resp/../../../src/utils/os.h	3
tests/fuzzing/pasn-resp/../../../src/common/sae.c	40
tests/fuzzing/pasn-resp/../../../src/common/dragonfly.c	3
tests/fuzzing/pasn-resp/../../../src/crypto/dh_groups.c	1
tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.h	1
tests/fuzzing/pasn-resp/../../../src/common/defs.h	3
tests/fuzzing/pasn-resp/../../../src/crypto/sha256-prf.c	2
tests/fuzzing/pasn-resp/../../../src/crypto/sha384-prf.c	2

Fuzzer: dpp-uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3084	95.5%
gold	[1:9]	5	0.15%
yellow	[10:29]	19	0.58%
greenyellow	[30:49]	22	0.68%
lawngreen	50+	96	2.97%
All colors	3226	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
18	18	1 : View List ['ieee80211_chan_to_freq_us']	53	96	ieee80211_chan_to_freq	call site: 00064	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1973
15	15	1 : View List ['ieee80211_chan_to_freq_eu']	35	73	ieee80211_chan_to_freq	call site: 00066	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1979
14	14	1 : View List ['ieee80211_chan_to_freq_jp']	20	53	ieee80211_chan_to_freq	call site: 00068	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1985
13	13	2 : View List ['__ctype_b_loc', 'wpa_debug_print_timestamp']	13	13	_wpa_hexdump_ascii	call site: 00018	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:423
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00120	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
6	6	1 : View List ['ieee80211_chan_to_freq_cn']	6	34	ieee80211_chan_to_freq	call site: 00070	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1991
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	0	None	6914	6914	dpp_relay_flush_controllers	call site: 03213	/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_tcp.c:2379
0	0	None	3474	3474	dpp_controller_free	call site: 03221	/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_tcp.c:721
0	0	None	26	26	openssl_digest_vector	call site: 00136	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:286
0	0	None	18	18	openssl_digest_vector	call site: 00137	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:288
0	0	None	18	18	openssl_digest_vector	call site: 00141	/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c:295

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

557

Reachable functions

619

Percentage of reachable functions covered

10.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/dpp-uri/dpp-uri.c	1
tests/fuzzing/dpp-uri/../fuzzer-common.c	1
src/utils/os_unix.c	11
tests/fuzzing/dpp-uri/../../../src/common/dpp.c	89
tests/fuzzing/dpp-uri/../../../src/utils/list.h	3
src/utils/wpa_debug.c	9
src/common/ieee802_11_common.c	8
src/utils/common.c	14
src/utils/ip_addr.c	2
src/utils/base64.c	7
tests/fuzzing/dpp-uri/../../../src/common/dpp_crypto.c	39
tests/fuzzing/dpp-uri/../../../src/crypto/crypto_openssl.c	65
src/utils/../utils/os.h	3
tests/fuzzing/dpp-uri/../../../src/utils/os.h	1
tests/fuzzing/dpp-uri/../../../src/common/dpp_tcp.c	37
src/utils/eloop.c	8
src/utils/../utils/list.h	3
src/utils/wpabuf.c	8
src/utils/../utils/wpabuf.h	4
tests/fuzzing/dpp-uri/../../../src/crypto/sha256-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/crypto/sha384-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/crypto/sha512-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/utils/wpa_debug.h	2
tests/fuzzing/dpp-uri/../../../src/utils/wpabuf.h	13
src/utils/json.c	20
tests/fuzzing/dpp-uri/../../../src/utils/common.h	8
tests/fuzzing/dpp-uri/../../../src/crypto/aes-siv.c	7
tests/fuzzing/dpp-uri/../../../src/crypto/aes-ctr.c	1
src/common/gas.c	2
src/common/../utils/wpabuf.h	1
tests/fuzzing/dpp-uri/../../../src/common/dpp_auth.c	14
tests/fuzzing/dpp-uri/../../../src/common/dpp_backup.c	17
tests/fuzzing/dpp-uri/../../../src/common/dpp_reconfig.c	5
tests/fuzzing/dpp-uri/../../../src/common/dpp_pkex.c	11
tests/fuzzing/dpp-uri/../../../src/tls/asn1.c	22
tests/fuzzing/dpp-uri/../../../src/tls/asn1.h	7
/usr/include/openssl/x509.h	2

Fuzzer: p2p

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	707	54.9%
gold	[1:9]	44	3.41%
yellow	[10:29]	39	3.03%
greenyellow	[30:49]	38	2.95%
lawngreen	50+	459	35.6%
All colors	1287	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2077	3124	12 : View List ['wpabuf_len.1482', 'p2p_unlink_sd_query', 'WPA_GET_BE32.1508', 'wpabuf_put_data.1483', 'p2p_continue_find', 'p2p_free_sd_query', 'wpabuf_resize', 'wpabuf_head.1481', 'p2p_send_gas_comeback_req', 'p2p_clear_timeout', 'WPA_GET_LE16.1495', 'wpabuf_free']	2077	3224	p2p_rx_gas_comeback_resp	call site: 00000	/src/hostap/src/p2p/p2p_sd.c:709
2077	3104	8 : View List ['p2p_unlink_sd_query', 'WPA_GET_BE32.1508', 'p2p_continue_find', 'p2p_free_sd_query', 'p2p_send_gas_comeback_req', 'p2p_clear_timeout', 'WPA_GET_LE16.1495', 'wpabuf_free']	2077	3189	p2p_rx_gas_initial_resp	call site: 00000	/src/hostap/src/p2p/p2p_sd.c:494
2050	2442	5 : View List ['p2p_parse_free', 'p2p_set_timeout', 'p2p_parse', 'memcmp', 'p2p_set_state']	2050	2467	p2p_process_dev_disc_resp	call site: 00000	/src/hostap/src/p2p/p2p_dev_disc.c:225
1058	3022	10 : View List ['p2p_parse_free', 'p2p_channel_random_social', 'p2p_check_pref_chan', 'p2p_channel_to_freq', 'p2p_invite_send', 'p2p_parse', 'p2p_clear_timeout', 'p2p_channels_intersect', 'p2p_peer_channels_check', 'p2p_set_state']	1058	3047	p2p_process_invitation_resp	call site: 00000	/src/hostap/src/p2p/p2p_invitation.c:459
1025	1025	1 : View List ['p2p_go_neg_failed']	1025	1045	p2p_device_free	call site: 00346	/src/hostap/src/p2p/p2p.c:932
563	905	14 : View List ['p2p_buf_add_channel_list', 'p2p_is_peer_6ghz_capab', 'p2p_buf_add_operating_channel', 'p2p_buf_add_feature_capability', 'p2ps_add_new_group_info', 'p2p_buf_add_device_info', 'p2p_buf_add_config_timeout', 'p2p_buf_add_capability', 'p2p_buf_add_connection_capability', 'p2p_buf_add_intended_addr', 'p2p_buf_add_persistent_group_info', 'is_zero_ether_addr.1305', 'p2p_buf_add_session_id', 'is_p2p_6ghz_capable']	615	1129	p2p_build_prov_disc_resp	call site: 00000	/src/hostap/src/p2p/p2p_pd.c:300
386	411	10 : View List ['p2p_check_pref_chan_recv', 'os_snprintf_error.754', 'p2p_channels_includes', 'p2p_is_peer_6ghz_capab', 'p2p_check_pref_chan_no_recv', 'p2p_freq_to_channel', 'p2p_dbg', 'p2p_pref_freq_allowed', 'is_6ghz_freq', 'is_p2p_6ghz_capable']	386	411	p2p_check_pref_chan	call site: 00000	/src/hostap/src/p2p/p2p_go_neg.c:709
292	932	12 : View List ['p2p_parse_free', 'wpabuf_alloc', 'p2p_build_probe_resp_ies', 'p2p_service_find_asp', 'p2p_match_dev_type', 'memcmp', 'is_broadcast_ether_addr', 'wpabuf_len', 'p2p_parse_ies', 'p2p_build_probe_resp_buf', 'wpabuf_free', 'supp_rates_11b_only']	292	1002	p2p_reply_probe	call site: 01096	/src/hostap/src/p2p/p2p.c:2376
129	129	1 : View List ['p2p_buf_add_service_instance']	129	129	p2p_build_probe_resp_ies	call site: 00866	/src/hostap/src/p2p/p2p.c:2267
119	1511	8 : View List ['p2p_build_presence_resp', 'p2p_parse_free', 'p2p_group_presence_req', 'p2p_parse', 'wpabuf_head', 'wpabuf_len', 'wpabuf_free', 'p2p_send_action']	119	1526	p2p_process_presence_req	call site: 00000	/src/hostap/src/p2p/p2p.c:4549
116	131	2 : View List ['p2p_pref_channel_filter', 'p2p_channels_dump']	202	628	p2p_build_go_neg_resp	call site: 00000	/src/hostap/src/p2p/p2p_go_neg.c:350
80	1117	7 : View List ['wpabuf_len.1482', 'p2p_build_gas_comeback_resp', 'wpabuf_head_u8.1516', 'wpabuf_head.1481', 'memcmp', 'wpabuf_free', 'p2p_send_action']	80	1142	p2p_rx_gas_comeback_req	call site: 00000	/src/hostap/src/p2p/p2p_sd.c:641

Runtime coverage analysis

Covered functions

197

Functions that are reachable but not covered

167

Reachable functions

364

Percentage of reachable functions covered

54.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/p2p/p2p.c	12
tests/fuzzing/p2p/../fuzzer-common.c	1
src/utils/os_unix.c	6
src/utils/eloop.c	11
src/utils/../utils/list.h	5
src/utils/wpa_debug.c	6
src/p2p/p2p.c	71
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	3
src/p2p/../utils/list.h	3
src/p2p/p2p_utils.c	16
src/p2p/../utils/os.h	4
src/utils/../utils/os.h	2
src/p2p/p2p_parse.c	7
src/common/ieee802_11_common.c	18
src/common/../utils/common.h	3
src/common/./ieee802_11_common.h	1
src/utils/wpabuf.c	7
src/common/../utils/wpabuf.h	8
src/utils/../utils/wpabuf.h	5
src/wps/wps_attr_parse.c	5
src/wps/../utils/wpabuf.h	7
src/wps/../utils/common.h	4
src/wps/../utils/wpa_debug.h	1
src/p2p/../utils/common.h	11
src/wps/wps_common.c	1
src/wps/../utils/os.h	1
src/p2p/../utils/wpabuf.h	13
src/utils/common.c	4
src/p2p/../utils/wpa_debug.h	1
src/p2p/p2p_pd.c	8
src/p2p/p2p_build.c	29
src/p2p/p2p_sd.c	6
src/common/gas.c	7
src/p2p/p2p_go_neg.c	3
src/wps/wps_attr_build.c	3
src/p2p/p2p_invitation.c	2
src/p2p/p2p_group.c	2

Fuzzer: eapol-key-supp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1512	78.5%
gold	[1:9]	22	1.14%
yellow	[10:29]	8	0.41%
greenyellow	[30:49]	10	0.51%
lawngreen	50+	373	19.3%
All colors	1925	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2172	2172	1 : View List ['wpa_sm_rx_eapol_wpa']	2172	2178	wpa_sm_rx_eapol	call site: 00536	/src/hostap/src/rsn_supp/wpa.c:3633
1604	2377	3 : View List ['eapol_sm_notify_portValid', 'wpa_supplicant_key_neg_complete', 'wpa_ft_prepare_auth_request']	1604	2665	wpa_sm_notify_assoc	call site: 01777	/src/hostap/src/rsn_supp/wpa.c:4115
1200	1200	1 : View List ['rsn_preauth_deinit']	2804	3871	wpa_sm_notify_assoc	call site: 01775	/src/hostap/src/rsn_supp/wpa.c:4111
833	833	2 : View List ['eap_notify_lower_layer_success', 'eapol_sm_step']	833	833	eapol_sm_notify_lower_layer_success	call site: 00093	/src/hostap/src/eapol_supp/eapol_supp_sm.c:1836
780	780	1 : View List ['eapol_sm_step']	780	780	eapol_sm_notify_portValid	call site: 00833	/src/hostap/src/eapol_supp/eapol_supp_sm.c:1488
492	492	1 : View List ['wpa_supplicant_process_mlo_1_of_2']	492	498	wpa_sm_rx_eapol	call site: 01592	/src/hostap/src/rsn_supp/wpa.c:3774
229	229	1 : View List ['wpa_derive_ptk_ft']	229	229	wpa_derive_ptk	call site: 00954	/src/hostap/src/rsn_supp/wpa.c:634
226	226	1 : View List ['wpa_parse_wpa_ie_rsn']	226	226	wpa_compare_rsn_ie	call site: 00685	/src/hostap/src/common/wpa_common.c:2733
145	145	1 : View List ['wpa_supplicant_pairwise_mlo_gtk']	1790	1870	wpa_supplicant_process_3_of_4	call site: 01492	/src/hostap/src/rsn_supp/wpa.c:2607
61	61	1 : View List ['wpa_sm_set_ap_wpa_ie']	61	61	supp_get_beacon_ie	call site: 01675	/src/hostap/tests/fuzzing/eapol-key-supp/eapol-key-supp.c:169
50	50	1 : View List ['wpa_gen_wpa_ie_wpa']	50	50	wpa_gen_wpa_ie	call site: 01728	/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c:337
48	48	1 : View List ['wpa_supplicant_activate_ptk']	1981	2912	wpa_supplicant_process_3_of_4	call site: 01481	/src/hostap/src/rsn_supp/wpa.c:2590

Runtime coverage analysis

Covered functions

154

Functions that are reachable but not covered

349

Reachable functions

503

Percentage of reachable functions covered

30.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-key-supp/eapol-key-supp.c	17
tests/fuzzing/eapol-key-supp/../fuzzer-common.c	1
src/utils/os_unix.c	9
src/utils/eloop.c	18
src/utils/../utils/list.h	5
src/utils/wpa_debug.c	8
tests/fuzzing/eapol-key-supp/../../../src/utils/common.h	1
src/utils/../utils/os.h	4
src/rsn_supp/wpa.c	71
src/common/wpa_common.c	30
src/utils/common.c	6
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/rsn_supp/../utils/common.h	7
src/eapol_supp/eapol_supp_sm.c	50
src/eap_peer/eap.c	62
src/utils/wpabuf.c	6
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
src/crypto/sha1-internal.c	5
src/eap_peer/../utils/common.h	4
src/utils/../utils/wpabuf.h	5
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	2
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/sha1.c	2
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/rsn_supp/./wpa_i.h	19
src/rsn_supp/../common/wpa_common.h	3
src/common/../utils/common.h	3
src/common/../utils/os.h	1
src/rsn_supp/../common/defs.h	8
src/common/./defs.h	7
src/rsn_supp/pmksa_cache.c	12
src/rsn_supp/wpa_ft.c	6
src/crypto/sha256-prf.c	2
src/common/ieee802_11_common.c	3
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/rsn_supp/../utils/list.h	3
src/rsn_supp/preauth.c	8
src/l2_packet/l2_packet_linux.c	4
src/l2_packet/../utils/common.h	1
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/eap_peer/../utils/list.h	1
src/rsn_supp/wpa_ie.c	5
src/rsn_supp/tdls.c	20
src/rsn_supp/../rsn_supp/wpa_i.h	4

Fuzzer: eapol-supp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1214	68.9%
gold	[1:9]	33	1.87%
yellow	[10:29]	28	1.59%
greenyellow	[30:49]	19	1.07%
lawngreen	50+	467	26.5%
All colors	1761	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2172	2172	1 : View List ['wpa_sm_rx_eapol_wpa']	2172	2178	wpa_sm_rx_eapol	call site: 00619	/src/hostap/src/rsn_supp/wpa.c:3633
2056	2056	1 : View List ['wpa_supplicant_process_3_of_4']	2056	2062	wpa_sm_rx_eapol	call site: 01489	/src/hostap/src/rsn_supp/wpa.c:3758
774	774	1 : View List ['eapol_sm_abort_cached']	774	1602	eapol_sm_rx_eapol	call site: 00566	/src/hostap/src/eapol_supp/eapol_supp_sm.c:1370
229	229	1 : View List ['wpa_derive_ptk_ft']	229	229	wpa_derive_ptk	call site: 01037	/src/hostap/src/rsn_supp/wpa.c:634
89	309	7 : View List ['eap_msg_alloc', 'eap_update_len', 'wpa_hexdump', 'wpabuf_put_u8', 'eap_sm_build_expanded_nak', 'wpabuf_put', 'eap_allowed_method']	89	309	eap_sm_buildNak	call site: 00417	/src/hostap/src/eap_peer/eap.c:1460
76	76	3 : View List ['crypto_private_key_free', 'x509_certificate_chain_free', 'free']	76	76	tlsv1_cred_free	call site: 01314	/src/hostap/src/tls/tlsv1_cred.c:31
70	70	2 : View List ['wpabuf_put_be24', 'wpabuf_put_be32']	70	70	eap_msg_alloc	call site: 00350	/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_common/eap_common.c:146
53	833	2 : View List ['eap_notify_lower_layer_success', 'eapol_sm_step']	53	833	eapol_sm_notify_lower_layer_success	call site: 00610	/src/hostap/src/eapol_supp/eapol_supp_sm.c:1836
50	50	1 : View List ['wpa_gen_wpa_ie_wpa']	50	50	wpa_gen_wpa_ie	call site: 00519	/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c:337
47	84	2 : View List ['wpa_msg', 'sm_EAP_FAILURE_Enter']	47	84	sm_EAP_Step	call site: 00188	/src/hostap/src/eap_peer/eap.c:1370
47	47	2 : View List ['wpa_insert_pmkid', 'malloc']	47	440	wpa_supplicant_send_2_of_4	call site: 00000	/src/hostap/src/rsn_supp/wpa.c:543
40	355	10 : View List ['wpabuf_alloc', 'wpabuf_put_data', 'eap_sm_request_identity', 'wpabuf_head.1514', 'eap_msg_alloc', 'wpabuf_len.1515', 'wpabuf_put_u8', 'wpabuf_free', 'wpabuf_put_str', 'wpa_hexdump_ascii']	40	355	eap_sm_buildIdentity	call site: 00370	/src/hostap/src/eap_peer/eap.c:1679

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

252

Reachable functions

466

Percentage of reachable functions covered

45.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-supp/eapol-supp.c	9
tests/fuzzing/eapol-supp/../fuzzer-common.c	1
src/utils/os_unix.c	9
src/utils/eloop.c	14
src/utils/../utils/list.h	4
src/utils/wpa_debug.c	8
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/rsn_supp/wpa.c	66
src/rsn_supp/../utils/list.h	3
src/rsn_supp/pmksa_cache.c	12
src/utils/../utils/os.h	3
src/utils/common.c	6
src/rsn_supp/./wpa_i.h	19
src/eapol_supp/eapol_supp_sm.c	50
src/utils/wpabuf.c	6
src/eap_peer/eap.c	62
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
src/crypto/sha1-internal.c	5
src/eap_peer/../utils/common.h	4
src/utils/../utils/wpabuf.h	5
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	2
src/rsn_supp/wpa_ie.c	5
src/rsn_supp/../utils/common.h	6
src/common/wpa_common.c	30
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/sha1.c	2
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/rsn_supp/../common/wpa_common.h	3
src/common/../utils/common.h	3
src/common/../utils/os.h	1
src/rsn_supp/../common/defs.h	8
src/common/./defs.h	7
src/rsn_supp/wpa_ft.c	5
src/crypto/sha256-prf.c	2
src/common/ieee802_11_common.c	3
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/rsn_supp/preauth.c	8
src/l2_packet/l2_packet_linux.c	4
src/l2_packet/../utils/common.h	1
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/eap_peer/../utils/list.h	1

Fuzzer: eapol-key-auth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	929	62.6%
gold	[1:9]	4	0.26%
yellow	[10:29]	2	0.13%
greenyellow	[30:49]	9	0.60%
lawngreen	50+	539	36.3%
All colors	1483	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
80	80	2 : View List ['sm_WPA_PTK_GROUP_REKEYESTABLISHED_Enter', 'sm_WPA_PTK_GROUP_KEYERROR_Enter']	1524	1524	sm_WPA_PTK_GROUP_Step	call site: 00418	/src/hostap/src/ap/wpa_auth.c:4294
67	67	1 : View List ['wpa_parse_wpa_ie_wpa']	238	355	wpa_validate_wpa_ie	call site: 01104	/src/hostap/src/ap/wpa_auth_ie.c:629
63	108	3 : View List ['eloop_deplete_timeout', 'eloop_register_timeout', 'wpa_auth_logger']	63	1100	wpa_auth_sta_deinit	call site: 01242	/src/hostap/src/ap/wpa_auth.c:803
50	50	1 : View List ['wpa_write_wpa_ie']	50	50	wpa_auth_gen_wpa_ie	call site: 01039	/src/hostap/src/ap/wpa_auth_ie.c:542
47	47	1 : View List ['wpa_insert_pmkid']	78	1600	sm_WPA_PTK_PTKINITNEGOTIATING_Enter	call site: 00807	/src/hostap/src/ap/wpa_auth.c:3759
45	45	1 : View List ['sm_WPA_PTK_INITPMK_Enter']	45	45	sm_WPA_PTK_Step	call site: 00628	/src/hostap/src/ap/wpa_auth.c:4000
35	35	1 : View List ['sha256_prf']	35	224	wpa_pmk_to_ptk	call site: 00312	/src/hostap/src/common/wpa_common.c:513
31	31	2 : View List ['wpa_write_ftie', 'WPA_PUT_LE32']	31	1499	sm_WPA_PTK_PTKINITNEGOTIATING_Enter	call site: 00824	/src/hostap/src/ap/wpa_auth.c:3791
26	26	1 : View List ['wpa_group_free']	26	26	wpa_group_put	call site: 00547	/src/hostap/src/ap/wpa_auth.c:5327
11	11	1 : View List ['wpa_write_osen']	64	152	wpa_auth_gen_wpa_ie	call site: 00992	/src/hostap/src/ap/wpa_auth_ie.c:518
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00034	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
5	20	3 : View List ['rsn_selector_to_bitfield', 'wpa_cipher_valid_mgmt_group', 'WPA_GET_BE32.699']	5	41	wpa_parse_wpa_ie_rsn	call site: 00741	/src/hostap/src/common/wpa_common.c:1873

Runtime coverage analysis

Covered functions

182

Functions that are reachable but not covered

187

Reachable functions

369

Percentage of reachable functions covered

49.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-key-auth/eapol-key-auth.c	12
tests/fuzzing/eapol-key-auth/../fuzzer-common.c	1
src/utils/os_unix.c	8
src/utils/eloop.c	14
src/utils/../utils/list.h	5
src/utils/wpa_debug.c	8
tests/fuzzing/eapol-key-auth/../../../src/utils/common.h	1
src/utils/../utils/os.h	3
src/ap/wpa_auth.c	82
src/common/wpa_common.c	38
src/ap/../utils/common.h	7
src/common/./defs.h	7
src/ap/../common/defs.h	11
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/utils/common.c	5
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/common/ieee802_11_common.c	2
src/crypto/sha256-prf.c	2
src/ap/wpa_auth_ft.c	62
src/crypto/sha1-prf.c	1
src/ap/../utils/list.h	4
src/ap/wpa_auth_ie.c	9
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/crypto/aes-wrap.c	1
src/crypto/rc4.c	1
src/utils/wpabuf.c	6
src/common/../utils/common.h	5
src/common/../utils/os.h	1
src/crypto/aes-siv.c	6
src/crypto/aes-ctr.c	1
src/ap/pmksa_cache_auth.c	10
src/radius/radius.c	2
src/utils/../utils/wpabuf.h	5
src/radius/../utils/os.h	1
src/ap/../utils/wpabuf.h	2

Fuzzer: ap-mgmt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3353	94.6%
gold	[1:9]	1	0.02%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	188	5.30%
All colors	3542	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
27597	27597	12 : View List ['notify_mgmt_frame', 'sta_track_add', 'handle_auth', 'handle_action', 'handle_disassoc', 'handle_deauth', 'handle_assoc', 'hostapd_logger', 'handle_probe_req', 'is_broadcast_ether_addr.3784', 'memcmp', 'wpa_msg']	27597	27597	ieee802_11_mgmt	call site: 02636	/src/hostap/src/ap/ieee802_11.c:5503
1063	1063	1 : View List ['ieee802_11_set_beacons']	1235	8252	ap_free_sta	call site: 00962	/src/hostap/src/ap/sta_info.c:289
171	171	7 : View List ['ap_sta_wpa_get_dpp_pkhash', 'wpa_snprintf_hex', 'strlen', 'ap_sta_wpa_get_keyid', 'wpa_msg', 'wpa_msg_no_global', 'os_strlcpy']	171	171	ap_sta_set_authorized	call site: 00534	/src/hostap/src/ap/sta_info.c:1280
57	62	2 : View List ['vlan_remove_dynamic', 'hostapd_drv_sta_remove']	63	113	ap_free_sta	call site: 00967	/src/hostap/src/ap/sta_info.c:316
52	52	1 : View List ['radius_client_flush_auth']	172	222	ap_free_sta	call site: 00967	/src/hostap/src/ap/sta_info.c:304
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00000	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
6	6	1 : View List ['hostapd_set_wds_sta']	1246	9481	ap_free_sta	call site: 00561	/src/hostap/src/ap/sta_info.c:200
5	5	1 : View List ['hostapd_drv_br_delete_ip_neigh']	1240	9475	ap_free_sta	call site: 00564	/src/hostap/src/ap/sta_info.c:203
2	2	1 : View List ['memcmp']	2	2	ap_sta_hash_del	call site: 00571	/src/hostap/src/ap/sta_info.c:137
2	2	1 : View List ['alarm']	2	2	eloop_process_pending_signals	call site: 03472	/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/eloop.c:1007
2	2	1 : View List ['clock_gettime']	2	2	os_get_reltime	call site: 00049	/src/hostap/tests/fuzzing/asn1/../../../src/utils/os_unix.c:94
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

789

Reachable functions

888

Percentage of reachable functions covered

11.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/ap-mgmt/ap-mgmt.c	4
tests/fuzzing/ap-mgmt/../fuzzer-common.c	1
src/utils/os_unix.c	10
src/utils/eloop.c	21
src/utils/../utils/list.h	5
src/utils/wpa_debug.c	10
src/ap/ap_config.c	17
src/ap/../utils/os.h	6
src/ap/../utils/list.h	6
src/ap/sta_info.c	30
src/ap/accounting.c	7
src/radius/radius.c	26
src/utils/../utils/os.h	4
src/utils/common.c	11
src/radius/radius_client.c	20
src/utils/wpabuf.c	7
src/radius/../utils/os.h	2
src/utils/../utils/wpabuf.h	5
src/ap/../radius/radius.h	1
src/radius/../utils/wpabuf.h	8
src/ap/ieee802_1x.c	13
src/ap/../utils/common.h	11
src/ap/../common/defs.h	11
src/ap/wpa_auth.c	82
src/common/wpa_common.c	39
src/ap/../utils/wpabuf.h	11
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/ap/./ap_drv_ops.h	6
src/utils/ip_addr.c	1
src/crypto/md5-internal.c	5
src/radius/../utils/common.h	2
src/crypto/md5.c	2
src/ap/ap_drv_ops.c	17
src/ap/ndisc_snoop.c	1
src/ap/ieee802_11_ht.c	13
src/ap/beacon.c	35
src/ap/hostapd.c	2
src/ap/ieee802_11.c	46
src/common/ieee802_11_common.c	27
src/ap/./ieee802_11.h	3
src/ap/ieee802_11_shared.c	22
src/ap/dfs.c	4
src/ap/./ap_config.h	3
src/common/../utils/common.h	6
src/ap/wmm.c	10
src/ap/hs20.c	5
src/wps/wps.c	2
src/wps/../utils/wpabuf.h	8
src/wps/../utils/common.h	5
src/wps/wps_attr_build.c	3
src/common/hw_features_common.c	3
src/eapol_auth/eapol_auth_sm.c	36
src/eap_server/eap_server_methods.c	2
src/eapol_auth/../utils/wpabuf.h	2
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	5
src/eap_server/eap_server.c	54
src/eap_server/../utils/wpabuf.h	4
src/eap_server/../utils/common.h	2
src/eap_common/../utils/common.h	2
src/ap/ap_mlme.c	5
src/crypto/sha1-prf.c	1
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/common/./defs.h	7
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/aes-wrap.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/rc4.c	1
src/crypto/aes-omac1.c	4
src/ap/wpa_auth_ie.c	8
src/crypto/sha256-prf.c	2
src/ap/wpa_auth_ft.c	68
src/common/../utils/os.h	1
src/crypto/aes-siv.c	6
src/crypto/aes-ctr.c	1
src/ap/wps_hostapd.c	2
src/ap/./preauth_auth.h	1
src/ap/vlan_init.c	4
src/ap/gas_serv.c	1
src/ap/ieee802_11_auth.c	7
src/ap/./mbo_ap.h	1
tests/fuzzing/ap-mgmt/../../../src/utils/common.h	1
src/common/./ieee802_11_common.h	1
src/ap/ap_list.c	9
src/ap/hw_features.c	2
src/ap/vlan.c	1
src/ap/vlan_ifconfig.c	3
src/ap/./sta_info.h	1
src/common/../utils/wpabuf.h	1
src/wps/wps_attr_parse.c	5
src/wps/../utils/wpa_debug.h	1
src/ap/../wps/wps.h	1
src/ap/pmksa_cache_auth.c	8
src/ap/../common/ptksa_cache.h	1
src/ap/rrm.c	12

Fuzzer: wnm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5397	96.7%
gold	[1:9]	12	0.21%
yellow	[10:29]	2	0.03%
greenyellow	[30:49]	3	0.05%
lawngreen	50+	162	2.90%
All colors	5576	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9508	9512	3 : View List ['os_get_reltime', 'wnm_scan_process', 'os_reltime_expired.3194']	9508	19063	ieee802_11_rx_bss_trans_mgmt_req	call site: 05514	/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c:1582
18	18	1 : View List ['ieee80211_chan_to_freq_us']	53	96	ieee80211_chan_to_freq	call site: 04410	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1973
15	15	1 : View List ['ieee80211_chan_to_freq_eu']	35	73	ieee80211_chan_to_freq	call site: 04412	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1979
14	14	1 : View List ['ieee80211_chan_to_freq_jp']	20	53	ieee80211_chan_to_freq	call site: 04414	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1985
12	54	2 : View List ['eloop_register_timeout', 'eloop_cancel_timeout']	12	54	eloop_deplete_timeout	call site: 00126	/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/eloop.c:917
11	11	1 : View List ['wpa_debug_print_timestamp']	11	11	_wpa_hexdump	call site: 00032	/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c:281
8	8	4 : View List ['add_freq', 'chan_supported', 'os_calloc.3172', 'free']	8	8	wnm_set_scan_freqs	call site: 05534	/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c:1287
6	6	1 : View List ['ieee80211_chan_to_freq_cn']	6	34	ieee80211_chan_to_freq	call site: 04416	/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c:1991
2	2	1 : View List ['alarm']	2	2	eloop_process_pending_signals	call site: 05546	/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/eloop.c:1007
2	2	1 : View List ['clock_gettime']	2	2	os_get_reltime	call site: 00024	/src/hostap/tests/fuzzing/asn1/../../../src/utils/os_unix.c:94
2	2	1 : View List ['atoi']	2	2	wpa_fuzzer_set_debug_level	call site: 00002	/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c:23
0	0	None	10758	10836	wnm_fetch_scan_results	call site: 05515	/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c:1336

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

1249

Reachable functions

1329

Percentage of reachable functions covered

6.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/wnm/wnm.c	4
tests/fuzzing/wnm/../fuzzer-common.c	1
src/utils/os_unix.c	11
src/utils/eloop.c	21
src/utils/../utils/list.h	5
src/utils/wpa_debug.c	9
src/utils/../utils/os.h	4
tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c	33
tests/fuzzing/wnm/../../../src/utils/common.h	12
src/rsn_supp/wpa.c	82
src/common/wpa_common.c	37
src/common/../utils/common.h	4
src/utils/common.c	20
tests/fuzzing/wnm/../../../wpa_supplicant/scan.c	57
tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant.c	72
tests/fuzzing/wnm/../../../src/utils/os.h	8
tests/fuzzing/wnm/../../../wpa_supplicant/notify.c	37
tests/fuzzing/wnm/../../../wpa_supplicant/dbus/dbus_new.h	11
tests/fuzzing/wnm/../../../src/utils/list.h	6
tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant_i.h	2
tests/fuzzing/wnm/../../../src/common/defs.h	10
tests/fuzzing/wnm/../../../wpa_supplicant/bssid_ignore.c	6
tests/fuzzing/wnm/../../../wpa_supplicant/driver_i.h	29
tests/fuzzing/wnm/../../../wpa_supplicant/p2p_supplicant.h	14
tests/fuzzing/wnm/../../../wpa_supplicant/sme.h	13
tests/fuzzing/wnm/../../../wpa_supplicant/autoscan.h	3
tests/fuzzing/wnm/../../../wpa_supplicant/wmm_ac.c	24
src/eapol_supp/eapol_supp_sm.c	55
src/eap_peer/eap.c	64
src/utils/wpabuf.c	7
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/crypto/sha1-internal.c	5
src/eap_peer/../utils/common.h	4
src/utils/../utils/wpabuf.h	5
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	3
tests/fuzzing/wnm/../../../wpa_supplicant/events.c	80
tests/fuzzing/wnm/../../../src/drivers/driver_common.c	6
tests/fuzzing/wnm/../../../wpa_supplicant/bss.c	32
tests/fuzzing/wnm/../../../wpa_supplicant/bss.h	4
src/common/ieee802_11_common.c	34
tests/fuzzing/wnm/../../../wpa_supplicant/wps_supplicant.h	10
src/rsn_supp/wpa_ie.c	7
src/rsn_supp/../utils/common.h	9
tests/fuzzing/wnm/../../../wpa_supplicant/wpas_glue.c	5
src/rsn_supp/preauth.c	12
src/rsn_supp/../utils/list.h	4
src/rsn_supp/pmksa_cache.c	16
src/rsn_supp/../common/defs.h	9
src/rsn_supp/../common/wpa_common.h	3
src/common/./defs.h	7
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/sha1.c	2
src/rsn_supp/./wpa_i.h	19
src/l2_packet/l2_packet_linux.c	9
src/l2_packet/../utils/common.h	1
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/eap_peer/../utils/list.h	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/rsn_supp/tdls.c	21
src/rsn_supp/../rsn_supp/wpa_i.h	4
tests/fuzzing/wnm/../../../wpa_supplicant/rrm.c	29
tests/fuzzing/wnm/../../../src/utils/wpabuf.h	11
src/utils/bitfield.c	4
tests/fuzzing/wnm/../../../wpa_supplicant/robust_av.c	20
tests/fuzzing/wnm/../../../src/common/ptksa_cache.h	1
tests/fuzzing/wnm/../../../src/rsn_supp/wpa.h	2
tests/fuzzing/wnm/../../../src/utils/wpa_debug.h	1
tests/fuzzing/wnm/../../../wpa_supplicant/bgscan.h	3
tests/fuzzing/wnm/../../../wpa_supplicant/interworking.c	60
tests/fuzzing/wnm/../../../wpa_supplicant/hs20_supplicant.c	24
src/common/gas.c	8
src/common/../utils/wpabuf.h	7
tests/fuzzing/wnm/../../../wpa_supplicant/gas_query.c	22
tests/fuzzing/wnm/../../../wpa_supplicant/offchannel.c	5
tests/fuzzing/wnm/../../../wpa_supplicant/config.c	13
src/common/./ieee802_11_common.h	1
src/common/../utils/os.h	1
src/rsn_supp/wpa_ft.c	6
src/crypto/sha256-prf.c	2
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
tests/fuzzing/wnm/../../../wpa_supplicant/op_classes.c	6
tests/fuzzing/wnm/../../../wpa_supplicant/mesh_mpm.h	2
tests/fuzzing/wnm/../../../wpa_supplicant/config_file.c	18
src/utils/base64.c	2
src/crypto/sha1-pbkdf2.c	2