High level conclusions

Fuzzers reach 63.49% of cyclomatic complexity.

Fuzzers reach 58.23% of all functions.

Fuzzer wnm is blocked:

The runtime code coverage of wnm covers 6.370% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ap-mgmt is blocked:

The runtime code coverage of ap-mgmt covers 10.72% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dpp-uri is blocked:

The runtime code coverage of dpp-uri covers 10.01% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer tls-server is blocked:

The runtime code coverage of tls-server covers 29.87% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pasn-resp is blocked:

The runtime code coverage of pasn-resp covers 26.80% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3104 / 5330

Cyclomatic complexity statically reachable by fuzzers

24187 / 38092

Runtime code coverage of functions

1175 / 5330

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	9.85%
gold	[1:9]	3	4.22%
yellow	[10:29]	7	9.85%
greenyellow	[30:49]	3	4.22%
lawngreen	50+	51	71.8%
All colors	71	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	6	json_alloc_token	call site: 00006	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

12

Reachable functions

29

Percentage of reachable functions covered

58.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/json/json.c	1
tests/fuzzing/json/../fuzzer-common.c	1
tests/fuzzing/json/../../../src/utils/json.c	9
tests/fuzzing/json/../../../src/utils/wpa_debug.c	2
tests/fuzzing/json/../../../src/utils/os_unix.c	2
tests/fuzzing/json/../../../src/utils/common.c	3
tests/fuzzing/json/../../../src/utils/os.h	1

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	29	34.1%
gold	[1:9]	6	7.05%
yellow	[10:29]	8	9.41%
greenyellow	[30:49]	1	1.17%
lawngreen	50+	41	48.2%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	67	wpa_hexdump_ascii	call site: 00067	wpa_debug_print_timestamp
7	5	asn1_parse	call site: 00005	wpa_printf
6	39	wpa_hexdump	call site: 00039	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi
1	35	asn1_parse	call site: 00035	wpa_printf
1	47	asn1_parse	call site: 00047	wpa_printf

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

9

Reachable functions

28

Percentage of reachable functions covered

67.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/asn1/asn1.c	3
tests/fuzzing/asn1/../fuzzer-common.c	1
tests/fuzzing/asn1/../../../src/tls/asn1.c	8
tests/fuzzing/asn1/../../../src/utils/wpa_debug.c	6
tests/fuzzing/asn1/../../../src/utils/os_unix.c	1
tests/fuzzing/asn1/../../../src/tls/asn1.h	1
tests/fuzzing/asn1/../../../src/utils/os.h	1

Fuzzer: eap-aka-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	1	2.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	50.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	18	wpabuf_put	call site: 00018	wpabuf_overflow
11	35	wpa_hexdump	call site: 00035	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

12

Reachable functions

32

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-aka-peer/eap-aka-peer.c	3
tests/fuzzing/eap-aka-peer/../fuzzer-common.c	1
tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c	1
src/utils/os_unix.c	2
tests/fuzzing/eap-aka-peer/../../../src/utils/common.h	1
src/utils/wpabuf.c	5
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/eap-aka-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-aka-peer/../../../src/utils/wpabuf.h	2

Fuzzer: x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	15.2%
gold	[1:9]	25	7.04%
yellow	[10:29]	24	6.76%
greenyellow	[30:49]	17	4.78%
lawngreen	50+	235	66.1%
All colors	355	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	105	wpa_hexdump_ascii	call site: 00105	wpa_debug_print_timestamp
11	45	wpa_hexdump	call site: 00045	wpa_debug_print_timestamp
9	8	asn1_get_next	call site: 00008	wpa_debug_print_timestamp
2	350	x509_certificate_parse	call site: 00350	x509_certificate_free
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi
1	39	x509_certificate_parse	call site: 00039	wpa_printf
1	42	x509_certificate_free	call site: 00042	x509_certificate_free
1	101	x509_parse_name	call site: 00101	x509_free_name
1	133	x509_parse_name	call site: 00133	x509_free_name
1	160	x509_parse_time	call site: 00160	wpa_printf
1	199	x509_parse_public_key	call site: 00199	wpa_printf

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

17

Reachable functions

91

Percentage of reachable functions covered

81.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/x509/x509.c	1
tests/fuzzing/x509/../fuzzer-common.c	1
src/tls/x509v3.c	40
src/utils/os_unix.c	5
src/tls/asn1.c	10
src/utils/wpa_debug.c	6
src/tls/./asn1.h	11
src/utils/common.c	1
src/tls/../utils/os.h	1

Fuzzer: eap-sim-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	1	2.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	50.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	18	wpabuf_put	call site: 00018	wpabuf_overflow
11	35	wpa_hexdump	call site: 00035	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

96

Functions that are reachable but not covered

12

Reachable functions

32

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-sim-peer/eap-sim-peer.c	3
tests/fuzzing/eap-sim-peer/../fuzzer-common.c	1
tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c	1
src/utils/os_unix.c	2
tests/fuzzing/eap-sim-peer/../../../src/utils/common.h	1
src/utils/wpabuf.c	5
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/eap-sim-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-sim-peer/../../../src/utils/wpabuf.h	2

Fuzzer: sae

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	108	43.9%
gold	[1:9]	3	1.21%
yellow	[10:29]	3	1.21%
greenyellow	[30:49]	15	6.09%
lawngreen	50+	117	47.5%
All colors	246	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	118	sae_parse_commit	call site: 00118	sae_parse_commit_element_ffc
25	182	wpa_hexdump_ascii	call site: 00182	wpa_debug_print_timestamp
11	90	wpa_hexdump	call site: 00090	wpa_debug_print_timestamp
10	10	sae_group_allowed	call site: 00010	wpa_printf
5	79	crypto_bignum_init_set	call site: 00079	sae_clear_data
5	234	sae_parse_akm_suite_selector	call site: 00234	wpa_printf
4	74	sae_set_group	call site: 00074	sae_clear_data
4	176	sae_parse_password_identifier	call site: 00176	wpa_printf
3	160	crypto_ec_point_from_bin	call site: 00160	BN_clear_free
3	219	wpabuf_put	call site: 00219	wpabuf_overflow
2	106	crypto_bignum_cmp	call site: 00106	wpa_printf
2	147	crypto_bignum_to_bin	call site: 00147	BN_num_bits

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

46

Reachable functions

104

Percentage of reachable functions covered

55.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/sae/sae.c	1
tests/fuzzing/sae/../fuzzer-common.c	1
src/utils/os_unix.c	5
src/common/sae.c	18
src/common/../utils/common.h	2
src/utils/wpa_debug.c	6
tests/fuzzing/sae/../../../src/common/dragonfly.c	1
tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c	20
src/utils/wpabuf.c	4
src/utils/common.c	2
tests/fuzzing/sae/../../../src/crypto/dh_groups.c	1
src/common/../utils/wpabuf.h	3
src/utils/./wpabuf.h	3
src/common/../utils/wpa_debug.h	1

Fuzzer: pasn-init

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	795	69.8%
gold	[1:9]	27	2.37%
yellow	[10:29]	15	1.31%
greenyellow	[30:49]	3	0.26%
lawngreen	50+	298	26.1%
All colors	1138	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
183	735	wpas_pasn_set_pmk	call site: 00735	wpas_pasn_wd_sae_rx
118	223	wpa_hexdump	call site: 00223	sae_derive_pwe_from_pt_ffc
88	925	sha256_prf_bits	call site: 00925	wpas_pasn_wd_fils_rx
68	342	wpabuf_put_u8	call site: 00342	wpas_pasn_wd_fils_auth
38	1080	wpa_pasn_auth_rx	call site: 01080	wpas_pasn_build_auth_3
27	640	wpa_parse_wpa_ie_rsn	call site: 00640	wpa_parse_wpa_ie_rsn
25	156	sae_clear_data	call site: 00156	sae_prepare_commit_pt
20	433	wpa_pasn_add_rsne	call site: 00433	fils_pmkid_erp
15	138	crypto_bignum_deinit	call site: 00138	crypto_bignum_deinit
14	183	wpabuf_put_le16	call site: 00183	sae_derive_pwe_from_pt_ecc
13	198	wpa_hexdump_key	call site: 00198	hkdf_extract
12	14	wpas_pasn_start	call site: 00014	wpa_printf

Runtime coverage analysis

Covered functions

103

Functions that are reachable but not covered

192

Reachable functions

294

Percentage of reachable functions covered

34.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/pasn-init/pasn-init.c	1
tests/fuzzing/pasn-init/../fuzzer-common.c	1
tests/fuzzing/pasn-init/../../../src/utils/os_unix.c	7
tests/fuzzing/pasn-init/../../../src/utils/common.c	7
tests/fuzzing/pasn-init/../../../src/pasn/pasn_initiator.c	16
tests/fuzzing/pasn-init/../../../src/common/dragonfly.c	3
tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.c	7
tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c	9
tests/fuzzing/pasn-init/../../../src/crypto/crypto_openssl.c	46
tests/fuzzing/pasn-init/../../../src/utils/wpabuf.c	7
tests/fuzzing/pasn-init/../../../src/utils/wpabuf.h	11
tests/fuzzing/pasn-init/../../../src/common/wpa_common.c	31
tests/fuzzing/pasn-init/../../../src/common/defs.h	4
tests/fuzzing/pasn-init/../../../src/rsn_supp/pmksa_cache.c	2
tests/fuzzing/pasn-init/../../../src/common/sae.c	41
tests/fuzzing/pasn-init/../../../src/crypto/dh_groups.c	1
tests/fuzzing/pasn-init/../../../src/utils/common.h	6
tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.h	1
tests/fuzzing/pasn-init/../../../src/eapol_supp/eapol_supp_sm.h	4
tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.h	1
tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c	1
tests/fuzzing/pasn-init/../../../src/crypto/sha256-prf.c	2
tests/fuzzing/pasn-init/../../../src/crypto/sha384-prf.c	2
tests/fuzzing/pasn-init/../../../src/pasn/pasn_common.c	1

Fuzzer: pasn-resp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	806	75.6%
gold	[1:9]	58	5.44%
yellow	[10:29]	44	4.12%
greenyellow	[30:49]	4	0.37%
lawngreen	50+	154	14.4%
All colors	1066	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
303	391	wpa_hexdump_key	call site: 00391	sae_parse_commit
172	780	handle_auth_pasn_resp	call site: 00780	pasn_get_wrapped_data
81	695	pasn_use_sha384	call site: 00695	pasn_derive_keys
50	340	bin_clear_free	call site: 00340	sae_prepare_commit_pt
34	161	os_get_reltime	call site: 00161	wpa_pasn_add_parameter_ie
30	309	ieee802_11_defrag	call site: 00309	pasn_wd_handle_sae_commit
26	1012	handle_auth_pasn_3	call site: 01012	pasn_wd_handle_sae_confirm
13	953	pasn_mic_len	call site: 00953	pasn_mic
10	196	wpabuf_put_data	call site: 00196	wpabuf_put_le16
7	8	eloop_init	call site: 00008	wpa_printf
6	56	wpa_hexdump	call site: 00056	wpa_debug_print_timestamp
5	138	openssl_hmac_vector	call site: 00138	hmac_sha256_vector

Runtime coverage analysis

Covered functions

79

Functions that are reachable but not covered

213

Reachable functions

291

Percentage of reachable functions covered

26.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/pasn-resp/pasn-resp.c	3
tests/fuzzing/pasn-resp/../fuzzer-common.c	1
tests/fuzzing/pasn-resp/../../../src/utils/os_unix.c	8
tests/fuzzing/pasn-resp/../../../src/utils/eloop.c	4
tests/fuzzing/pasn-resp/../../../src/utils/list.h	2
tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.c	7
tests/fuzzing/pasn-resp/../../../src/pasn/pasn_common.c	3
tests/fuzzing/pasn-resp/../../../src/utils/common.c	7
tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c	10
tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.c	8
tests/fuzzing/pasn-resp/../../../src/utils/common.h	7
tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.h	1
tests/fuzzing/pasn-resp/../../../src/common/wpa_common.c	25
tests/fuzzing/pasn-resp/../../../src/ap/comeback_token.c	3
tests/fuzzing/pasn-resp/../../../src/crypto/crypto_openssl.c	46
tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.c	7
tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.h	11
tests/fuzzing/pasn-resp/../../../src/utils/os.h	3
tests/fuzzing/pasn-resp/../../../src/common/sae.c	40
tests/fuzzing/pasn-resp/../../../src/common/dragonfly.c	3
tests/fuzzing/pasn-resp/../../../src/crypto/dh_groups.c	1
tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.h	1
tests/fuzzing/pasn-resp/../../../src/common/defs.h	3
tests/fuzzing/pasn-resp/../../../src/crypto/sha256-prf.c	2
tests/fuzzing/pasn-resp/../../../src/crypto/sha384-prf.c	2

Fuzzer: tls-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1518	82.0%
gold	[1:9]	280	15.1%
yellow	[10:29]	24	1.29%
greenyellow	[30:49]	17	0.91%
lawngreen	50+	12	0.64%
All colors	1851	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
310	962	tlsv1_record_set_cipher_suite	call site: 00962	tls_process_certificate
239	1585	tlsv1_record_change_write_cipher	call site: 01585	tls_write_server_key_exchange
192	521	crypto_rsa_import_private_key	call site: 00521	pkcs8_enc_key_import
161	1423	tlsv1_record_change_read_cipher	call site: 01423	tlsv1_server_handshake_write
149	1273	crypto_public_key_free	call site: 01273	x509_certificate_chain_validate
85	874	LLVMFuzzerTestOneInput	call site: 00874	tls_connection_server_handshake
32	777	tls_verify_hash_free	call site: 00777	sha384_done
27	149	wpa_hexdump_ascii	call site: 00149	wpa_printf
26	334	x509_parse_ext_basic_constraints	call site: 00334	x509_parse_ext_certificate_policies
19	307	x509_parse_alt_name_dns	call site: 00307	x509_parse_ext_issuer_alt_name
17	856	read_msg	call site: 00856	wpabuf_put_data
16	822	crypto_hash_init	call site: 00822	sha256_done

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

284

Reachable functions

405

Percentage of reachable functions covered

29.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/tls-server/tls-server.c	2
tests/fuzzing/tls-server/../fuzzer-common.c	1
src/crypto/tls_internal.c	11
src/tls/tlsv1_client.c	10
src/crypto/crypto_internal.c	5
src/tls/tlsv1_server.c	14
src/utils/os_unix.c	8
src/tls/tlsv1_cred.c	15
src/tls/x509v3.c	59
src/utils/wpa_debug.c	8
src/crypto/crypto_internal-rsa.c	8
src/tls/rsa.c	6
src/tls/bignum.c	12
src/tls/./libtommath.c	42
src/utils/common.c	7
src/tls/asn1.c	10
src/tls/./asn1.h	12
src/tls/../utils/os.h	1
src/utils/base64.c	2
src/tls/pkcs8.c	2
src/tls/pkcs5.c	13
src/tls/../utils/common.h	6
src/crypto/sha1-pbkdf2.c	2
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/crypto/crypto_internal-cipher.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/aes-internal-dec.c	5
src/crypto/./aes_i.h	1
src/crypto/des-internal.c	9
src/crypto/md5-internal.c	5
src/crypto/rc4.c	1
src/crypto/../utils/common.h	4
src/tls/tlsv1_common.c	12
src/crypto/sha256-internal.c	5
src/crypto/sha384-internal.c	4
src/crypto/sha512-internal.c	5
tests/fuzzing/tls-server/../../../src/utils/common.h	1
src/utils/wpabuf.c	7
tests/fuzzing/tls-server/../../../src/utils/wpabuf.h	4
src/utils/./wpabuf.h	4
tests/fuzzing/tls-server/../../../src/utils/wpa_debug.h	1
src/crypto/../utils/wpabuf.h	4
src/tls/tlsv1_record.c	5
src/tls/tlsv1_server_read.c	12
src/crypto/crypto_internal-modexp.c	1
src/crypto/sha256-tlsprf.c	1
src/crypto/sha256.c	2
src/crypto/sha1-tlsprf.c	1
src/crypto/md5.c	2
src/tls/pkcs1.c	4
src/tls/tlsv1_server_write.c	13
src/tls/../utils/wpabuf.h	4

Fuzzer: radius

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	29.5%
gold	[1:9]	1	0.53%
yellow	[10:29]	6	3.22%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	124	66.6%
All colors	186	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	20	wpabuf_put	call site: 00020	wpabuf_overflow
11	162	wpa_hexdump	call site: 00162	wpa_debug_print_timestamp
5	49	radius_msg_add_attr	call site: 00049	wpabuf_resize
4	55	radius_msg_add_attr	call site: 00055	wpabuf_put_data
3	66	radius_msg_add_attr	call site: 00066	wpabuf_put_data
3	91	hmac_md5_vector	call site: 00091	wpa_printf
2	41	radius_msg_add_msg_auth	call site: 00041	wpa_printf
2	95	radius_msg_finish	call site: 00095	wpa_printf
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi
1	14	os_calloc	call site: 00014	radius_msg_free
1	36	radius_msg_auth_pos	call site: 00036	radius_get_attr_hdr
1	44	radius_msg_add_attr	call site: 00044	wpa_printf

Runtime coverage analysis

Covered functions

61

Functions that are reachable but not covered

21

Reachable functions

82

Percentage of reachable functions covered

74.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/radius/radius.c	1
tests/fuzzing/radius/../fuzzer-common.c	1
src/utils/os_unix.c	6
tests/fuzzing/radius/../../../src/radius/radius.c	23
src/utils/wpabuf.c	6
tests/fuzzing/radius/../../../src/utils/os.h	2
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/radius/../../../src/utils/wpabuf.h	8
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/utils/common.c	4
src/utils/../utils/os.h	1
tests/fuzzing/radius/../../../src/utils/common.h	2
tests/fuzzing/radius/../../../src/utils/wpa_debug.h	1

Fuzzer: dpp-uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3337	95.8%
gold	[1:9]	6	0.17%
yellow	[10:29]	16	0.45%
greenyellow	[30:49]	24	0.68%
lawngreen	50+	98	2.81%
All colors	3481	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3256	211	dpp_global_clear	call site: 00211	dpp_connection_remove
29	18	wpa_hexdump_ascii	call site: 00018	wpa_debug_print_timestamp
11	121	wpa_hexdump	call site: 00121	wpa_debug_print_timestamp
6	3468	dpp_global_clear	call site: 03468	dpp_relay_controller_free
5	49	dpp_parse_uri	call site: 00049	wpa_debug_print_timestamp
5	205	dpp_global_clear	call site: 00205	dpp_configurator_free
4	139	openssl_digest_vector	call site: 00139	wpa_printf
4	144	openssl_digest_vector	call site: 00144	wpa_printf
4	149	openssl_digest_vector	call site: 00149	wpa_printf
3	3476	dpp_controller_stop	call site: 03476	dpp_connection_remove
2	179	dpp_bootstrap_info_free	call site: 00179	forced_memzero
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

557

Reachable functions

619

Percentage of reachable functions covered

10.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/dpp-uri/dpp-uri.c	1
tests/fuzzing/dpp-uri/../fuzzer-common.c	1
src/utils/os_unix.c	11
tests/fuzzing/dpp-uri/../../../src/common/dpp.c	90
tests/fuzzing/dpp-uri/../../../src/utils/list.h	3
src/utils/wpa_debug.c	9
src/common/ieee802_11_common.c	8
src/utils/common.c	14
src/utils/ip_addr.c	2
src/utils/base64.c	7
tests/fuzzing/dpp-uri/../../../src/common/dpp_crypto.c	40
tests/fuzzing/dpp-uri/../../../src/crypto/crypto_openssl.c	67
src/utils/../utils/os.h	2
tests/fuzzing/dpp-uri/../../../src/utils/os.h	1
tests/fuzzing/dpp-uri/../../../src/common/dpp_tcp.c	37
src/utils/eloop.c	8
src/utils/./list.h	3
src/utils/./os.h	3
src/utils/wpabuf.c	8
src/utils/./wpabuf.h	5
tests/fuzzing/dpp-uri/../../../src/crypto/sha256-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/crypto/sha384-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/crypto/sha512-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/utils/wpa_debug.h	2
tests/fuzzing/dpp-uri/../../../src/utils/wpabuf.h	13
src/utils/json.c	20
tests/fuzzing/dpp-uri/../../../src/utils/common.h	8
tests/fuzzing/dpp-uri/../../../src/crypto/aes-siv.c	7
tests/fuzzing/dpp-uri/../../../src/crypto/aes-ctr.c	1
src/common/gas.c	2
src/common/../utils/wpabuf.h	1
tests/fuzzing/dpp-uri/../../../src/common/dpp_auth.c	14
tests/fuzzing/dpp-uri/../../../src/common/dpp_backup.c	17
tests/fuzzing/dpp-uri/../../../src/common/dpp_reconfig.c	5
tests/fuzzing/dpp-uri/../../../src/common/dpp_pkex.c	11
tests/fuzzing/dpp-uri/../../../src/tls/asn1.c	22
tests/fuzzing/dpp-uri/../../../src/tls/asn1.h	7
/usr/include/openssl/x509.h	2

Fuzzer: eap-mschapv2-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	1	2.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	50.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	18	wpabuf_put	call site: 00018	wpabuf_overflow
11	35	wpa_hexdump	call site: 00035	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

12

Reachable functions

32

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-mschapv2-peer/eap-mschapv2-peer.c	3
tests/fuzzing/eap-mschapv2-peer/../fuzzer-common.c	1
tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c	1
src/utils/os_unix.c	2
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/common.h	1
src/utils/wpabuf.c	5
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpabuf.h	2

Fuzzer: tls-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	681	38.5%
gold	[1:9]	103	5.83%
yellow	[10:29]	99	5.60%
greenyellow	[30:49]	41	2.32%
lawngreen	50+	841	47.6%
All colors	1765	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	1133	x509_certificate_chain_free	call site: 01133	tls_process_certificate_status_ocsp_response
63	1069	pkcs1_decrypt_public_key	call site: 01069	asn1_get_oid
57	810	x509_certificate_parse	call site: 00810	x509_certificate_check_signature
54	1341	tls_process_certificate	call site: 01341	x509_certificate_chain_validate
27	570	wpa_hexdump_ascii	call site: 00570	wpa_printf
24	1708	tlsv1_client_decrypt	call site: 01708	tlsv1_server_decrypt
23	418	tls_process_server_key_exchange	call site: 00418	tls_process_certificate_status
20	1561	tls_write_client_key_exchange	call site: 01561	tls_write_client_certificate_verify
18	1023	s_mp_exptmod	call site: 01023	bignum_exptmod
13	508	x509_parse_algorithm_identifier	call site: 00508	x509_certificate_parse
12	461	asn1_unexpected	call site: 00461	asn1_get_oid
12	1666	tls_connection_encrypt	call site: 01666	tlsv1_server_encrypt

Runtime coverage analysis

Covered functions

295

Functions that are reachable but not covered

88

Reachable functions

379

Percentage of reachable functions covered

76.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/tls-client/tls-client.c	2
tests/fuzzing/tls-client/../fuzzer-common.c	1
src/crypto/tls_internal.c	11
src/tls/tlsv1_client.c	14
src/crypto/crypto_internal.c	5
src/tls/tlsv1_server.c	11
src/utils/os_unix.c	7
src/tls/tlsv1_common.c	13
src/crypto/md5-internal.c	5
src/utils/common.c	4
src/crypto/sha1-internal.c	5
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/sha384-internal.c	4
src/crypto/sha512-internal.c	5
src/utils/wpa_debug.c	7
src/crypto/../utils/wpabuf.h	4
src/tls/tlsv1_client_write.c	13
src/tls/../utils/common.h	5
src/tls/tlsv1_record.c	5
src/crypto/crypto_internal-cipher.c	4
src/crypto/rc4.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/./aes_i.h	1
src/crypto/des-internal.c	9
src/utils/wpabuf.c	7
src/tls/../utils/wpabuf.h	4
src/utils/./wpabuf.h	4
src/crypto/aes-internal-dec.c	5
src/tls/tlsv1_client_read.c	17
src/crypto/sha256-tlsprf.c	1
src/crypto/sha256.c	2
src/crypto/sha1-tlsprf.c	1
src/crypto/md5.c	2
src/crypto/sha1.c	2
src/tls/tlsv1_client_ocsp.c	7
src/tls/asn1.c	10
src/tls/./asn1.h	13
src/tls/../utils/os.h	1
src/tls/x509v3.c	59
src/crypto/crypto_internal-rsa.c	7
src/tls/rsa.c	5
src/tls/bignum.c	11
src/tls/./libtommath.c	41
src/tls/pkcs1.c	3
src/crypto/aes-internal.c	1
src/crypto/crypto_internal-modexp.c	1
tests/fuzzing/tls-client/../../../src/utils/common.h	1
tests/fuzzing/tls-client/../../../src/utils/wpabuf.h	4
tests/fuzzing/tls-client/../../../src/utils/wpa_debug.h	1
src/tls/tlsv1_cred.c	1

Fuzzer: p2p

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1415	60.2%
gold	[1:9]	139	5.91%
yellow	[10:29]	86	3.65%
greenyellow	[30:49]	109	4.63%
lawngreen	50+	601	25.5%
All colors	2350	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
124	965	p2p_build_probe_resp_ies	call site: 00965	p2p_timeout_connect_listen
91	1370	p2p_peer_channels_check	call site: 01370	p2p_stop_find_for_freq
91	1531	p2p_process_go_neg_resp	call site: 01531	p2p_go_neg_wait_timeout
89	1206	p2p_reply_probe	call site: 01206	p2p_go_neg_start
75	375	p2p_clear_timeout	call site: 00375	p2p_state_timeout
47	740	wpabuf_mhead_u8	call site: 00740	p2p_send_action
47	2071	p2p_rx_gas_initial_resp	call site: 02071	p2p_sd_query_cb
39	1626	p2p_handle_go_neg_conf	call site: 01626	p2p_go_complete
37	2160	p2p_rx_gas_comeback_resp	call site: 02160	p2p_send_gas_comeback_req
37	2206	p2p_process_presence_req	call site: 02206	p2p_send_action
34	2122	p2p_rx_gas_comeback_req	call site: 02122	p2p_send_action
33	658	p2p_stop_listen_for_freq	call site: 00658	p2p_clear_timeout

Runtime coverage analysis

Covered functions

216

Functions that are reachable but not covered

168

Reachable functions

376

Percentage of reachable functions covered

55.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/p2p/p2p.c	3
tests/fuzzing/p2p/../fuzzer-common.c	1
src/utils/os_unix.c	7
src/utils/eloop.c	11
src/utils/./list.h	5
src/utils/wpa_debug.c	6
src/p2p/p2p.c	85
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	3
src/p2p/../utils/list.h	3
src/p2p/p2p_utils.c	20
src/p2p/../utils/os.h	4
src/utils/./os.h	2
src/p2p/p2p_parse.c	8
src/common/ieee802_11_common.c	20
src/common/../utils/common.h	3
src/common/./ieee802_11_common.h	1
src/utils/wpabuf.c	8
src/common/../utils/wpabuf.h	8
src/utils/./wpabuf.h	6
src/wps/wps_attr_parse.c	5
src/wps/../utils/wpabuf.h	7
src/wps/../utils/common.h	5
src/wps/../utils/wpa_debug.h	1
src/p2p/../utils/common.h	12
src/wps/wps_common.c	1
src/wps/../utils/os.h	1
src/p2p/../utils/wpabuf.h	13
src/utils/common.c	7
src/p2p/../utils/wpa_debug.h	1
src/p2p/p2p_pd.c	22
src/p2p/p2p_build.c	36
src/p2p/p2p_sd.c	14
src/common/gas.c	11
src/p2p/p2p_go_neg.c	19
src/wps/wps_attr_build.c	3
src/p2p/p2p_invitation.c	6
src/p2p/p2p_group.c	8
src/p2p/p2p_dev_disc.c	5

Fuzzer: eapol-supp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1347	71.5%
gold	[1:9]	40	2.12%
yellow	[10:29]	24	1.27%
greenyellow	[30:49]	19	1.00%
lawngreen	50+	452	24.0%
All colors	1882	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
198	1549	wpa_sm_rx_eapol	call site: 01549	wpa_supplicant_process_3_of_4
183	1231	wpa_supplicant_send_2_of_4	call site: 01231	wpa_supplicant_process_1_of_2_wpa
72	1095	wpa_derive_ptk	call site: 01095	wpa_derive_ptk_ft
70	693	omac1_aes_vector	call site: 00693	wpa_sm_tptk_to_ptk
58	1447	eapol_sm_deinit	call site: 01447	wpa_ft_prepare_auth_request
55	852	wpa_sm_rsn_overriding_supported	call site: 00852	wpa_supplicant_send_4_of_4
49	1783	wpa_supplicant_process_1_of_4	call site: 01783	wpa_supplicant_process_mlo_1_of_2
42	990	wpa_supplicant_get_pmk	call site: 00990	pmksa_cache_set_expiration
36	1042	pmksa_cache_set_expiration	call site: 01042	pmksa_cache_expire
28	421	eap_sm_buildNak	call site: 00421	eap_sm_build_expanded_nak
28	823	wpa_parse_kde_ies	call site: 00823	wpa_supplicant_validate_ie
25	317	wpa_hexdump_ascii	call site: 00317	wpa_debug_print_timestamp

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

250

Reachable functions

460

Percentage of reachable functions covered

45.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-supp/eapol-supp.c	4
tests/fuzzing/eapol-supp/../fuzzer-common.c	1
src/utils/os_unix.c	9
src/utils/eloop.c	18
src/utils/./list.h	5
src/utils/wpa_debug.c	8
src/rsn_supp/wpa.c	73
src/rsn_supp/../utils/list.h	3
src/rsn_supp/pmksa_cache.c	12
src/utils/./os.h	4
src/utils/common.c	4
src/rsn_supp/./wpa_i.h	21
src/eapol_supp/eapol_supp_sm.c	50
src/eap_peer/eap.c	62
src/eap_peer/../utils/list.h	1
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/utils/wpabuf.c	6
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/crypto/sha1-internal.c	5
src/eap_peer/../utils/common.h	4
src/utils/./wpabuf.h	5
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	2
src/rsn_supp/wpa_ie.c	5
src/rsn_supp/../utils/common.h	7
src/common/wpa_common.c	34
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/sha1.c	2
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/common/../utils/common.h	5
src/rsn_supp/../common/wpa_common.h	3
src/common/../utils/os.h	1
src/rsn_supp/../common/defs.h	8
src/common/./defs.h	7
src/rsn_supp/wpa_ft.c	5
src/crypto/sha256-prf.c	2
src/common/ieee802_11_common.c	4
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/rsn_supp/preauth.c	6
src/l2_packet/l2_packet_linux.c	3
src/l2_packet/../utils/common.h	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/common/../utils/wpabuf.h	2

Fuzzer: eapol-key-supp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1574	78.3%
gold	[1:9]	21	1.04%
yellow	[10:29]	13	0.64%
greenyellow	[30:49]	6	0.29%
lawngreen	50+	395	19.6%
All colors	2009	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
368	470	wpa_hexdump_ascii	call site: 00470	rsn_preauth_candidate_process
240	229	wpa_sm_notify_assoc	call site: 00229	rsn_preauth_deinit
75	1799	wpa_supplicant_process_3_of_4	call site: 01799	wpa_supplicant_key_neg_complete
73	952	omac1_aes_128	call site: 00952	wpa_tdls_tpk_send
72	1422	wpa_derive_ptk	call site: 01422	wpa_derive_ptk_ft
45	1692	wpa_supplicant_process_3_of_4	call site: 01692	wpa_supplicant_validate_link_kde
40	1593	aes_unwrap	call site: 01593	wpa_supplicant_key_neg_complete
39	63	wpa_hexdump_key	call site: 00063	rsn_pmkid
35	868	wpa_cipher_valid_group	call site: 00868	wpa_ft_mic
32	1258	wpa_supplicant_validate_ie	call site: 01258	wpa_supplicant_send_4_of_4
31	1374	wpa_supplicant_get_pmk	call site: 01374	wpa_supplicant_key_mgmt_set_pmk
28	923	wpa_tdls_assoc	call site: 00923	wpa_tdls_peer_free

Runtime coverage analysis

Covered functions

167

Functions that are reachable but not covered

334

Reachable functions

492

Percentage of reachable functions covered

32.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-key-supp/eapol-key-supp.c	6
tests/fuzzing/eapol-key-supp/../fuzzer-common.c	1
src/utils/os_unix.c	9
src/utils/eloop.c	18
src/utils/./list.h	5
src/utils/wpa_debug.c	8
src/rsn_supp/wpa.c	76
src/rsn_supp/../utils/list.h	3
src/rsn_supp/pmksa_cache.c	12
src/utils/./os.h	4
src/utils/common.c	4
src/rsn_supp/./wpa_i.h	21
src/rsn_supp/../common/defs.h	8
src/rsn_supp/../common/wpa_common.h	3
src/common/wpa_common.c	34
src/common/./defs.h	7
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/rsn_supp/../utils/common.h	8
src/eapol_supp/eapol_supp_sm.c	50
src/rsn_supp/wpa_ie.c	5
src/rsn_supp/preauth.c	6
src/utils/wpabuf.c	6
src/eap_peer/eap.c	62
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/eap_peer/../utils/common.h	4
src/utils/./wpabuf.h	5
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	2
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/l2_packet/l2_packet_linux.c	3
src/l2_packet/../utils/common.h	2
src/eap_peer/../utils/list.h	1
src/rsn_supp/wpa_ft.c	6
src/common/ieee802_11_common.c	4
src/common/../utils/wpabuf.h	2
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/rsn_supp/tdls.c	21
src/rsn_supp/../rsn_supp/wpa_i.h	4
tests/fuzzing/eapol-key-supp/../../../src/utils/common.h	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/common/../utils/common.h	5
src/common/../utils/os.h	1
src/crypto/sha256-prf.c	2
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5

Fuzzer: ap-mgmt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3729	94.7%
gold	[1:9]	1	0.02%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	206	5.23%
All colors	3936	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1051	781	wpa_hexdump	call site: 00781	ap_handle_timer
950	2908	dl_list_add_tail	call site: 02908	handle_assoc
470	1933	ap_free_sta	call site: 01933	ap_ht2040_timeout
253	281	eloop_remove_timeout	call site: 00281	accounting_interim_update
213	66	ap_free_sta	call site: 00066	accounting_sta_report
213	2570	__ieee802_11_parse_elems	call site: 02570	ap_sta_deauthenticate_common
202	578	hostapd_set_sta_flags	call site: 00578	ap_handle_timer
109	2439	ap_sta_clear_disconnect_timeouts	call site: 02439	ap_sta_disconnect
84	1833	ether_addr_equal	call site: 01833	ap_free_sta
39	536	ap_sta_set_authorized	call site: 00536	hostapd_prune_associations
23	2817	ap_free_sta	call site: 02817	ap_check_sa_query_timeout
16	2799	ap_free_sta	call site: 02799	vlan_remove_dynamic

Runtime coverage analysis

Covered functions

106

Functions that are reachable but not covered

882

Reachable functions

988

Percentage of reachable functions covered

10.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/ap-mgmt/ap-mgmt.c	4
tests/fuzzing/ap-mgmt/../fuzzer-common.c	1
src/utils/os_unix.c	11
src/utils/eloop.c	21
src/utils/./list.h	5
src/utils/wpa_debug.c	11
src/ap/ap_config.c	19
src/ap/../utils/os.h	6
src/ap/../utils/list.h	6
src/ap/./ap_config.h	4
src/ap/sta_info.c	45
src/ap/accounting.c	7
src/radius/radius.c	28
src/utils/./os.h	4
src/utils/common.c	13
src/radius/radius_client.c	20
src/utils/wpabuf.c	7
src/radius/../utils/os.h	2
src/utils/./wpabuf.h	5
src/ap/../radius/radius.h	1
src/radius/../utils/wpabuf.h	8
src/ap/ieee802_1x.c	12
src/ap/../utils/common.h	14
src/ap/../common/defs.h	11
src/ap/wpa_auth.c	103
src/common/wpa_common.c	44
src/ap/../utils/wpabuf.h	9
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/ap/./ap_drv_ops.h	6
src/utils/ip_addr.c	1
src/crypto/md5-internal.c	5
src/utils/../utils/os.h	2
src/radius/../utils/common.h	3
src/crypto/md5.c	2
src/ap/utils.c	2
src/ap/ap_drv_ops.c	20
src/eapol_auth/eapol_auth_sm.c	36
src/eap_server/eap_server_methods.c	2
src/eapol_auth/../utils/wpabuf.h	2
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	5
src/eap_server/eap_server.c	54
src/eap_server/../utils/wpabuf.h	4
src/eap_server/../utils/common.h	2
src/eap_common/../utils/common.h	2
src/ap/ap_mlme.c	5
src/crypto/sha1-prf.c	1
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/ap/./wpa_auth.h	1
src/common/./defs.h	7
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/aes-wrap.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/rc4.c	1
src/crypto/aes-omac1.c	4
src/ap/wpa_auth_ie.c	10
src/common/ieee802_11_common.c	31
src/crypto/sha256-prf.c	2
src/ap/wpa_auth_ft.c	68
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/common/../utils/common.h	7
src/common/../utils/os.h	1
src/crypto/aes-siv.c	6
src/crypto/aes-ctr.c	1
src/ap/ndisc_snoop.c	1
src/ap/ieee802_11_ht.c	14
src/ap/beacon.c	45
src/ap/hostapd.c	3
src/ap/ieee802_11.c	60
src/ap/./ieee802_11.h	3
src/ap/ieee802_11_shared.c	26
src/ap/dfs.c	4
src/ap/wmm.c	10
src/ap/hs20.c	1
src/crypto/sha1-pbkdf2.c	2
src/wps/wps.c	2
src/wps/../utils/wpabuf.h	8
src/wps/../utils/common.h	5
src/wps/wps_attr_build.c	3
src/common/hw_features_common.c	7
src/common/./ieee802_11_common.h	1
src/common/../utils/wpabuf.h	3
src/ap/wps_hostapd.c	2
src/ap/./preauth_auth.h	1
src/ap/vlan_init.c	4
src/ap/gas_serv.c	1
src/ap/ieee802_11_auth.c	7
src/ap/./mbo_ap.h	1
tests/fuzzing/ap-mgmt/../../../src/utils/common.h	1
src/ap/ap_list.c	11
src/ap/hw_features.c	2
src/ap/vlan.c	1
src/ap/vlan_ifconfig.c	3
src/ap/./sta_info.h	2
src/wps/wps_attr_parse.c	5
src/wps/../utils/wpa_debug.h	1
src/ap/../wps/wps.h	1
src/ap/pmksa_cache_auth.c	8
src/ap/../common/wpa_common.h	2
src/common/ptksa_cache.c	4
src/common/../utils/list.h	2
src/ap/rrm.c	14

Fuzzer: wnm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6373	96.8%
gold	[1:9]	13	0.19%
yellow	[10:29]	19	0.28%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	172	2.61%
All colors	6578	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1846	3583	wpabuf_head_u8	call site: 03583	interworking_anqp_resp_cb
1208	2374	wpabuf_mhead_u8	call site: 02374	wpas_clear_beacon_rep_data
1009	5509	ieee802_11_rx_wnm_action	call site: 05509	wpas_rrm_handle_radio_measurement_request
637	1147	wpa_supplicant_req_scan	call site: 01147	wpa_supplicant_scan
588	1785	dl_list_add_tail	call site: 01785	wpa_supplicant_deauthenticate
257	876	eloop_remove_timeout	call site: 00876	wpa_supplicant_req_scan
218	154	wpa_bss_get_ie	call site: 00154	wpa_scan_res_ok
171	497	wpa_supplicant_get_scan_results	call site: 00497	wpa_bss_update_scan_res
103	772	wpa_supplicant_select_bss	call site: 00772	wnm_bss_tm_connect
92	669	dl_list_add_tail	call site: 00669	wpa_bss_update
45	5430	ieee802_11_rx_wnm_action	call site: 05430	wnm_sleep_mode_exit_success
43	373	wpabuf_mhead_u8	call site: 00373	wnm_nei_rep_add_bss

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

1308

Reachable functions

1397

Percentage of reachable functions covered

6.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/wnm/wnm.c	4
tests/fuzzing/wnm/../fuzzer-common.c	1
src/utils/os_unix.c	12
src/utils/eloop.c	21
src/utils/./list.h	5
src/utils/wpa_debug.c	9
tests/fuzzing/wnm/../../../wpa_supplicant/bss.c	46
tests/fuzzing/wnm/../../../src/utils/list.h	6
src/utils/./os.h	4
tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c	34
tests/fuzzing/wnm/../../../src/utils/common.h	16
src/rsn_supp/wpa.c	95
src/common/wpa_common.c	41
src/common/../utils/common.h	6
src/utils/common.c	21
src/utils/wpabuf.c	7
tests/fuzzing/wnm/../../../wpa_supplicant/notify.c	41
tests/fuzzing/wnm/../../../wpa_supplicant/dbus/dbus_new.h	13
tests/fuzzing/wnm/../../../src/utils/wpabuf.h	14
src/utils/./wpabuf.h	5
tests/fuzzing/wnm/../../../src/utils/os.h	9
tests/fuzzing/wnm/../../../wpa_supplicant/events.c	96
tests/fuzzing/wnm/../../../wpa_supplicant/bss.h	4
tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant.c	104
src/common/ieee802_11_common.c	40
tests/fuzzing/wnm/../../../wpa_supplicant/bssid_ignore.c	6
tests/fuzzing/wnm/../../../wpa_supplicant/scan.c	62
tests/fuzzing/wnm/../../../src/common/defs.h	9
tests/fuzzing/wnm/../../../wpa_supplicant/wps_supplicant.h	10
src/rsn_supp/wpa_ie.c	6
src/rsn_supp/../utils/common.h	9
tests/fuzzing/wnm/../../../src/drivers/driver_common.c	6
src/common/./ieee802_11_common.h	1
src/common/../utils/wpabuf.h	8
tests/fuzzing/wnm/../../../src/utils/wpa_debug.h	1
src/eap_peer/eap.c	64
tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant_i.h	3
tests/fuzzing/wnm/../../../wpa_supplicant/driver_i.h	32
tests/fuzzing/wnm/../../../wpa_supplicant/p2p_supplicant.h	15
tests/fuzzing/wnm/../../../wpa_supplicant/sme.h	12
tests/fuzzing/wnm/../../../wpa_supplicant/robust_av.c	33
tests/fuzzing/wnm/../../../wpa_supplicant/autoscan.h	3
tests/fuzzing/wnm/../../../wpa_supplicant/wmm_ac.c	24
src/eapol_supp/eapol_supp_sm.c	55
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/crypto/sha1-internal.c	5
src/eap_peer/../utils/common.h	4
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	3
tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.h	1
tests/fuzzing/wnm/../../../wpa_supplicant/wpas_glue.c	5
src/rsn_supp/preauth.c	10
src/rsn_supp/../utils/list.h	4
src/rsn_supp/pmksa_cache.c	16
src/rsn_supp/../common/defs.h	9
src/rsn_supp/../common/wpa_common.h	3
src/common/./defs.h	7
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/sha1.c	2
src/rsn_supp/./wpa_i.h	20
src/l2_packet/l2_packet_linux.c	9
src/l2_packet/../utils/common.h	2
src/eap_peer/../utils/list.h	1
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/rsn_supp/tdls.c	22
src/rsn_supp/../rsn_supp/wpa_i.h	4
tests/fuzzing/wnm/../../../wpa_supplicant/rrm.c	30
tests/fuzzing/wnm/../../../wpa_supplicant/hs20_supplicant.c	9
src/utils/bitfield.c	4
src/common/ptksa_cache.c	4
src/common/../utils/list.h	2
src/crypto/sha1-pbkdf2.c	2
tests/fuzzing/wnm/../../../wpa_supplicant/op_classes.c	11
tests/fuzzing/wnm/../../../wpa_supplicant/config.c	13
src/utils/../utils/os.h	2
src/common/hw_features_common.c	9
tests/fuzzing/wnm/../../../src/rsn_supp/wpa.h	2
tests/fuzzing/wnm/../../../wpa_supplicant/bgscan.h	3
src/utils/crc32.c	1
tests/fuzzing/wnm/../../../wpa_supplicant/interworking.c	60
src/common/gas.c	8
tests/fuzzing/wnm/../../../wpa_supplicant/gas_query.c	22
tests/fuzzing/wnm/../../../wpa_supplicant/offchannel.c	5
src/common/../utils/os.h	1
src/rsn_supp/wpa_ft.c	6
src/crypto/sha256-prf.c	2
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
tests/fuzzing/wnm/../../../wpa_supplicant/mesh_mpm.h	2
tests/fuzzing/wnm/../../../wpa_supplicant/config_file.c	19
src/utils/base64.c	2

Fuzzer: eapol-key-auth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1117	71.4%
gold	[1:9]	1	0.06%
yellow	[10:29]	4	0.25%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	441	28.2%
All colors	1563	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
237	1293	wpa_auth_sta_deinit	call site: 01293	wpa_ft_expire_pull
94	518	wpa_derive_ptk	call site: 00518	wpa_auth_derive_ptk_ft
77	974	sm_WPA_PTK_PTKINITDONE_Enter	call site: 00974	wpa_ft_generate_pmk_r1
50	1161	wpa_validate_wpa_ie	call site: 01161	pmksa_cache_add_okc
49	681	wpa_parse_kde_ies	call site: 00681	wpa_parse_generic
44	822	sm_WPA_PTK_PTKCALCNEGOTIATING_Enter	call site: 00822	wpa_auth_ft_store_keys
36	316	hmac_sha1	call site: 00316	sha256_vector
34	1121	wpa_validate_wpa_ie	call site: 01121	wpa_parse_wpa_ie_wpa
33	780	sm_WPA_PTK_PTKCALCNEGOTIATING_Enter	call site: 00780	wpa_parse_wpa_ie_rsn
30	62	wpa_auth_gen_wpa_ie	call site: 00062	wpa_write_rsne_override
20	172	wpa_group_config_group_keys	call site: 00172	wpa_group_setkeys
19	760	wpa_parse_wpa_ie_rsn	call site: 00760	wpa_parse_wpa_ie_rsn

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

208

Reachable functions

394

Percentage of reachable functions covered

47.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-key-auth/eapol-key-auth.c	4
tests/fuzzing/eapol-key-auth/../fuzzer-common.c	1
src/utils/os_unix.c	8
src/utils/eloop.c	12
src/utils/./list.h	5
src/utils/wpa_debug.c	8
src/ap/wpa_auth.c	95
src/ap/wpa_auth_ie.c	13
src/ap/../utils/common.h	7
src/common/wpa_common.c	43
src/common/../utils/common.h	5
src/ap/../common/defs.h	11
src/ap/wpa_auth_ft.c	62
src/utils/common.c	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/crypto/sha1-prf.c	1
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/ap/./wpa_auth.h	1
src/common/./defs.h	7
src/crypto/aes-wrap.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/rc4.c	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/aes-omac1.c	4
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/utils/./os.h	3
src/utils/wpabuf.c	7
src/common/ieee802_11_common.c	10
src/crypto/sha256-prf.c	2
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/common/../utils/os.h	1
src/ap/../utils/list.h	4
src/crypto/aes-siv.c	6
src/crypto/aes-ctr.c	1
src/ap/pmksa_cache_auth.c	10
src/radius/radius.c	2
src/ap/../common/wpa_common.h	2
src/utils/./wpabuf.h	5
src/radius/../utils/os.h	1
src/ap/../utils/wpabuf.h	2
src/common/./ieee802_11_common.h	1
src/common/../utils/wpabuf.h	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
hostapd_dfs_radar_detected	/src/hostap/src/ap/dfs.c	7	['N/A', 'int', 'int', 'int', 'int', 'int', 'int']	38	0	147	19	9	1397	0	9701	2755
wpa_supplicant_add_iface	/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant.c	3	['N/A', 'N/A', 'N/A']	99	0	195	28	11	1489	0	11093	653
wps_get_msg	/src/hostap/src/wps/wps.c	2	['N/A', 'N/A']	16	0	39	6	3	228	0	1179	470

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3649 / 5330

Cyclomatic complexity statically reachable by fuzzers

28059 / 38092

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzzing/json/json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['json_alloc_token', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/asn1/asn1.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump_ascii', 'asn1_parse', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/eap-aka-peer/eap-aka-peer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/x509/x509.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump_ascii', 'wpa_hexdump', 'asn1_get_next', 'x509_certificate_parse', 'wpa_fuzzer_set_debug_level', 'x509_certificate_free', 'x509_parse_name', 'x509_parse_time']

tests/fuzzing/eap-sim-peer/eap-sim-peer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/sae/sae.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sae_parse_commit', 'wpa_hexdump_ascii', 'wpa_hexdump', 'sae_group_allowed', 'crypto_bignum_init_set', 'sae_parse_akm_suite_selector', 'sae_set_group', 'sae_parse_password_identifier', 'crypto_ec_point_from_bin', 'wpabuf_put']

tests/fuzzing/pasn-init/pasn-init.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpas_pasn_set_pmk', 'wpa_hexdump', 'sha256_prf_bits', 'wpabuf_put_u8', 'wpa_pasn_auth_rx', 'wpa_parse_wpa_ie_rsn', 'sae_clear_data', 'wpa_pasn_add_rsne', 'crypto_bignum_deinit', 'wpabuf_put_le16']

tests/fuzzing/pasn-resp/pasn-resp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump_key', 'handle_auth_pasn_resp', 'pasn_use_sha384', 'bin_clear_free', 'os_get_reltime', 'ieee802_11_defrag', 'handle_auth_pasn_3', 'pasn_mic_len', 'wpabuf_put_data', 'eloop_init']

tests/fuzzing/tls-server/tls-server.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tlsv1_record_set_cipher_suite', 'tlsv1_record_change_write_cipher', 'crypto_rsa_import_private_key', 'tlsv1_record_change_read_cipher', 'crypto_public_key_free', 'LLVMFuzzerTestOneInput', 'tls_verify_hash_free', 'wpa_hexdump_ascii', 'x509_parse_ext_basic_constraints', 'x509_parse_alt_name_dns']

tests/fuzzing/radius/radius.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'radius_msg_add_attr', 'hmac_md5_vector', 'radius_msg_add_msg_auth', 'radius_msg_finish', 'wpa_fuzzer_set_debug_level', 'os_calloc']

tests/fuzzing/dpp-uri/dpp-uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['dpp_global_clear', 'wpa_hexdump_ascii', 'wpa_hexdump', 'dpp_parse_uri', 'openssl_digest_vector', 'dpp_controller_stop']

tests/fuzzing/eap-mschapv2-peer/eap-mschapv2-peer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/tls-client/tls-client.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['x509_certificate_chain_free', 'pkcs1_decrypt_public_key', 'x509_certificate_parse', 'tls_process_certificate', 'wpa_hexdump_ascii', 'tlsv1_client_decrypt', 'tls_process_server_key_exchange', 'tls_write_client_key_exchange', 's_mp_exptmod', 'x509_parse_algorithm_identifier']

tests/fuzzing/p2p/p2p.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['p2p_build_probe_resp_ies', 'p2p_peer_channels_check', 'p2p_process_go_neg_resp', 'p2p_reply_probe', 'p2p_clear_timeout', 'wpabuf_mhead_u8', 'p2p_rx_gas_initial_resp', 'p2p_handle_go_neg_conf', 'p2p_rx_gas_comeback_resp', 'p2p_process_presence_req']

tests/fuzzing/eapol-supp/eapol-supp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_sm_rx_eapol', 'wpa_supplicant_send_2_of_4', 'wpa_derive_ptk', 'omac1_aes_vector', 'eapol_sm_deinit', 'wpa_sm_rsn_overriding_supported', 'wpa_supplicant_process_1_of_4', 'wpa_supplicant_get_pmk', 'pmksa_cache_set_expiration', 'eap_sm_buildNak']

tests/fuzzing/eapol-key-supp/eapol-key-supp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump_ascii', 'wpa_sm_notify_assoc', 'wpa_supplicant_process_3_of_4', 'omac1_aes_128', 'wpa_derive_ptk', 'aes_unwrap', 'wpa_hexdump_key', 'wpa_cipher_valid_group', 'wpa_supplicant_validate_ie']

tests/fuzzing/ap-mgmt/ap-mgmt.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump', 'dl_list_add_tail', 'ap_free_sta', 'eloop_remove_timeout', '__ieee802_11_parse_elems', 'hostapd_set_sta_flags', 'ap_sta_clear_disconnect_timeouts', 'ether_addr_equal', 'ap_sta_set_authorized']

tests/fuzzing/wnm/wnm.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_head_u8', 'wpabuf_mhead_u8', 'ieee802_11_rx_wnm_action', 'wpa_supplicant_req_scan', 'dl_list_add_tail', 'eloop_remove_timeout', 'wpa_bss_get_ie', 'wpa_supplicant_get_scan_results', 'wpa_supplicant_select_bss']

tests/fuzzing/eapol-key-auth/eapol-key-auth.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_auth_sta_deinit', 'wpa_derive_ptk', 'sm_WPA_PTK_PTKINITDONE_Enter', 'wpa_validate_wpa_ie', 'wpa_parse_kde_ies', 'sm_WPA_PTK_PTKCALCNEGOTIATING_Enter', 'hmac_sha1', 'wpa_auth_gen_wpa_ie']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
eap_sim_report_notification	39	21	53.84%	['eap-sim-peer', 'eap-aka-peer']
eap_aka_init	34	17	50.0%	['eap-aka-peer']
eap_aka_process_reauthentication	96	26	27.08%	['eap-aka-peer']
eap_sim_init	56	16	28.57%	['eap-sim-peer']
sae_set_group	53	18	33.96%	['pasn-init', 'pasn-resp', 'sae']
crypto_ec_group_2_nid	32	6	18.75%	['pasn-init', 'pasn-resp', 'dpp-uri', 'sae']
wpa_pasn_add_rsne	78	42	53.84%	['pasn-init', 'pasn-resp']
wpa_pasn_add_wrapped_data	35	6	17.14%	['pasn-init', 'pasn-resp']
crypto_ecdh_init	48	25	52.08%	['pasn-init', 'pasn-resp']
openssl_digest_vector	33	15	45.45%	['pasn-init', 'dpp-uri', 'pasn-resp']
wpas_pasn_start	43	11	25.58%	['pasn-init']
wpas_pasn_send_auth_1	54	29	53.70%	['pasn-init']
wpas_pasn_set_pmk	87	11	12.64%	['pasn-init']
handle_auth_pasn_resp	124	30	24.19%	['pasn-resp']
handle_auth_pasn_1	267	144	53.93%	['pasn-resp']
os_get_reltime	31	15	48.38%	['ap-mgmt', 'eapol-key-auth', 'eapol-supp', 'eapol-key-supp', 'wnm', 'p2p', 'dpp-uri', 'pasn-resp']
tls_global_set_params	42	22	52.38%	['tls-server']
tlsv1_set_ca_cert	45	9	20.0%	['tls-server']
tlsv1_set_dhparams_blob	33	17	51.51%	['tls-server']
radius_msg_add_attr	86	27	31.39%	['ap-mgmt', 'radius']
crypto_ec_key_group	38	20	52.63%	['dpp-uri']
utf8_to_ucs2	35	14	40.0%	['eap-mschapv2-peer']
eap_mschapv2_success	41	15	36.58%	['eap-mschapv2-peer']
crypto_cipher_init	51	26	50.98%	['tls-server', 'tls-client']
tls_connection_encrypt	41	15	36.58%	['tls-server', 'tls-client']
tls_connection_decrypt2	31	8	25.80%	['tls-server', 'tls-client']
tlsv1_client_decrypt	88	46	52.27%	['tls-server', 'tls-client']
tls_process_server_change_cipher_spec	55	27	49.09%	['tls-client']
tls_process_server_finished	113	51	45.13%	['tls-client']
tls_write_client_certificate	58	31	53.44%	['tls-client']
tlsv1_key_x_dh	108	54	50.0%	['tls-client']
p2p_probe_req_rx	31	11	35.48%	['p2p']
p2p_state_txt	32	6	18.75%	['p2p']
p2p_reply_probe	117	20	17.09%	['p2p']
p2p_process_presence_req	54	16	29.62%	['p2p']
p2p_process_dev_disc_resp	47	12	25.53%	['p2p']
p2p_check_pref_chan	80	9	11.25%	['p2p']
p2p_process_go_neg_req	253	88	34.78%	['p2p']
p2p_process_go_neg_resp	220	16	7.272%	['p2p']
p2p_handle_go_neg_conf	76	12	15.78%	['p2p']
p2p_build_go_neg_resp	109	57	52.29%	['p2p']
p2p_process_invitation_resp	125	21	16.8%	['p2p']
p2p_build_invitation_resp	63	28	44.44%	['p2p']
p2p_process_prov_disc_req	495	194	39.19%	['p2p']
p2p_build_prov_disc_resp	122	27	22.13%	['p2p']
p2p_process_prov_disc_bootstrap_resp	97	17	17.52%	['p2p']
p2p_process_prov_disc_resp	213	40	18.77%	['p2p']
p2p_rx_gas_initial_req	75	10	13.33%	['p2p']
p2p_rx_gas_initial_resp	122	15	12.29%	['p2p']
p2p_rx_gas_comeback_req	59	20	33.89%	['p2p']
p2p_rx_gas_comeback_resp	145	17	11.72%	['p2p']
wps_build_wfa_ext	40	18	45.0%	['ap-mgmt', 'p2p']
wpa_eapol_key_mic	71	15	21.12%	['ap-mgmt', 'eapol-key-auth', 'eapol-supp', 'wnm', 'eapol-key-supp']
eap_sm_buildIdentity	70	11	15.71%	['eapol-supp', 'wnm', 'eapol-key-supp']
sm_EAP_GET_METHOD_Enter	84	24	28.57%	['eapol-supp', 'wnm', 'eapol-key-supp']
eap_sm_buildNak	40	12	30.0%	['eapol-supp', 'wnm', 'eapol-key-supp']
sm_EAP_METHOD_Enter	51	9	17.64%	['eapol-supp', 'wnm', 'eapol-key-supp']
sm_SUPP_PAE_Step	84	34	40.47%	['eapol-supp', 'wnm', 'eapol-key-supp']
pmksa_cache_set_expiration	42	8	19.04%	['ap-mgmt', 'eapol-key-auth', 'eapol-supp', 'wnm', 'eapol-key-supp']
wpa_supplicant_send_2_of_4	107	42	39.25%	['eapol-supp', 'wnm', 'eapol-key-supp']
wpa_sm_set_param	91	25	27.47%	['eapol-supp', 'wnm', 'eapol-key-supp']
wpa_supplicant_get_pmk	146	18	12.32%	['eapol-supp', 'wnm', 'eapol-key-supp']
wpa_gen_wpa_ie_rsn	84	37	44.04%	['eapol-supp', 'wnm', 'eapol-key-supp']
wpa_supplicant_validate_ie	126	49	38.88%	['eapol-supp', 'wnm', 'eapol-key-supp']
wpa_supplicant_process_3_of_4	189	84	44.44%	['eapol-supp', 'wnm', 'eapol-key-supp']
wpa_handle_ext_key_id	35	17	48.57%	['eapol-supp', 'wnm', 'eapol-key-supp']
wpa_supplicant_process_1_of_2	77	16	20.77%	['eapol-supp', 'wnm', 'eapol-key-supp']
ieee802_11_mgmt	93	37	39.78%	['ap-mgmt']
hostapd_ht_operation_update	45	6	13.33%	['ap-mgmt']
wpa_supplicant_select_bss	41	15	36.58%	['wnm']
hs20_rx_deauth_imminent_notice	34	5	14.70%	['wnm']
wpa_supplicant_get_scan_results	36	9	25.0%	['wnm']
wnm_scan_process	72	19	26.38%	['wnm']
wnm_set_scan_freqs	75	7	9.333%	['wnm']
ieee802_11_rx_wnmsleep_resp	68	12	17.64%	['wnm']
wpa_init	53	23	43.39%	['eapol-key-auth']
wpa_auth_sta_associated	31	17	54.83%	['eapol-key-auth']
wpa_auth_sm_event	96	22	22.91%	['ap-mgmt', 'eapol-key-auth']
sm_WPA_PTK_PTKSTART_Enter	66	32	48.48%	['ap-mgmt', 'eapol-key-auth']
sm_WPA_PTK_PTKCALCNEGOTIATING_Enter	250	120	48.0%	['ap-mgmt', 'eapol-key-auth']
sm_WPA_PTK_PTKINITNEGOTIATING_Enter	223	91	40.80%	['ap-mgmt', 'eapol-key-auth']
ieee80211w_kde_add	48	23	47.91%	['ap-mgmt', 'eapol-key-auth']
wpa_gtk_update	46	25	54.34%	['ap-mgmt', 'eapol-key-auth']
wpa_ft_deinit_rkh_tmp	40	12	30.0%	['eapol-key-auth']
wpa_auth_gen_wpa_ie	69	35	50.72%	['eapol-key-auth']
wpa_validate_wpa_ie	304	115	37.82%	['ap-mgmt', 'eapol-key-auth']
rsne_write_data	112	42	37.5%	['ap-mgmt', 'eapol-key-auth']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/os.h	['wnm']	[]
/src/hostap/src/ap/./mbo_ap.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/p2p/../fuzzer-common.c	['p2p']	[]
/src/hostap/tests/fuzzing/asn1/asn1.c	['asn1']	['asn1']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/notify.c	['wnm']	[]
/src/hostap/src/ap/beacon.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/eapol-key-supp/../fuzzer-common.c	['eapol-key-supp']	[]
/src/hostap/src/ap/../radius/radius.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpabuf.c	['pasn-init']	['eap-aka-peer', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/common/ptksa_cache.c	['ap-mgmt', 'wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/dh_groups.c	['pasn-init']	[]
/src/hostap/src/tls/tlsv1_cred.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client', 'eapol-supp']
/src/hostap/src/tls/tlsv1_client_ocsp.c	['tls-client']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/list.h	['wnm']	[]
/src/hostap/tests/fuzzing/tls-server/../fuzzer-common.c	['tls-server']	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/wpa_debug.h	['eap-sim-peer']	[]
/src/hostap/src/ap/ap_drv_ops.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/ap/eth_p_oui.c	[]	[]
/src/hostap/src/ap/airtime_policy.c	[]	[]
/src/hostap/tests/fuzzing/asn1/../../../src/tls/asn1.c	['asn1']	['x509', 'tls-server', 'tls-client']
/src/hostap/tests/fuzzing/tls-server/tls-server.c	['tls-server']	['tls-server']
/src/hostap/src/l2_packet/l2_packet_linux.c	['eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/eap_register.c	[]	[]
/src/hostap/src/utils/eloop.c	['dpp-uri', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/const_time.h	[]	[]
/src/hostap/src/common/../utils/common.h	['sae', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/src/crypto/aes-cbc.c	[]	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_sim_common.c	[]	[]
/src/hostap/src/tls/tlsv1_common.c	['tls-server', 'tls-client']	['tls-server', 'tls-client']
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpabuf.h	['eap-mschapv2-peer']	[]
/src/hostap/src/rsn_supp/preauth.c	['eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/sha256-kdf.c	[]	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/wpabuf.c	[]	['eap-aka-peer', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/x509/../fuzzer-common.c	['x509']	[]
/src/hostap/tests/fuzzing/p2p/p2p.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/eap-mschapv2-peer/eap-mschapv2-peer.c	['eap-mschapv2-peer']	['eap-mschapv2-peer']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/config_file.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/pasn_common.c	['pasn-init']	[]
/src/hostap/src/rsn_supp/pmksa_cache.c	['eapol-supp', 'eapol-key-supp', 'wnm']	['eapol-supp', 'eapol-key-supp']
/src/hostap/src/eap_peer/eap_methods.c	['eapol-supp', 'eapol-key-supp', 'wnm']	['eapol-supp']
/src/hostap/tests/fuzzing/json/../../../src/utils/common.c	['json']	['x509', 'sae', 'tls-server', 'radius', 'dpp-uri', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/p2p/../utils/common.h	['p2p']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/pasn_common.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/common.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/tls-client/../fuzzer-common.c	['tls-client']	[]
/src/hostap/src/rsn_supp/../common/wpa_common.h	['eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/dh_groups.c	['sae']	[]
/src/hostap/src/ap/x_snoop.c	[]	[]
/src/hostap/src/common/./defs.h	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/src/crypto/aes-ctr.c	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/src/ap/ndisc_snoop.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/os.h	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/os_unix.c	['pasn-resp']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/utils/ip_addr.c	['dpp-uri', 'ap-mgmt']	['dpp-uri']
/src/hostap/src/common/../utils/wpa_debug.h	['sae']	[]
/src/hostap/tests/fuzzing/tls-client/../../../src/utils/wpa_debug.h	['tls-client']	[]
/src/hostap/src/crypto/dh_group5.c	[]	[]
/src/hostap/src/ap/../wps/wps.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/const_time.h	[]	[]
/src/hostap/src/tls/bignum.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client']
/src/hostap/src/utils/crc32.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha256-kdf.c	[]	[]
/src/hostap/src/ap/vlan_init.c	['ap-mgmt']	[]
/src/hostap/src/wps/../utils/wpa_debug.h	['p2p', 'ap-mgmt']	[]
/src/hostap/src/wps/../utils/os.h	['p2p']	[]
/src/hostap/src/common/../utils/const_time.h	[]	[]
/src/hostap/src/p2p/p2p_invitation.c	['p2p']	['p2p']
/src/hostap/src/crypto/md5-internal.c	['tls-server', 'radius', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-server', 'radius', 'tls-client']
/src/hostap/tests/fuzzing/sae/../fuzzer-common.c	['sae']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wps_supplicant.h	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/eap_peer/eap_methods.h	[]	[]
/src/hostap/src/ap/./wpa_auth_kay.h	[]	[]
/src/hostap/src/ap/../common/wpa_common.h	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/src/tls/tlsv1_client_write.c	['tls-client']	['tls-client']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant.c	['wnm']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/eap-aka-peer.c	['eap-aka-peer']	['eap-aka-peer']
/src/hostap/src/rsn_supp/wpa_ie.c	['eapol-supp', 'eapol-key-supp', 'wnm']	['eapol-supp', 'eapol-key-supp']
/src/hostap/src/crypto/aes-unwrap.c	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/crypto/des-internal.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/src/ap/rrm.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/eapol_supp/eapol_supp_sm.h	['pasn-init']	[]
/src/hostap/src/crypto/../utils/wpabuf.h	['tls-server', 'tls-client']	[]
/src/hostap/src/tls/../utils/wpabuf.h	['tls-server', 'tls-client']	[]
/src/hostap/src/rsn_supp/wpa_ft.c	['eapol-supp', 'eapol-key-supp', 'wnm']	['eapol-key-supp']
/src/hostap/src/crypto/sha256.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-client']
/src/hostap/src/wps/wps_dev_attr.c	[]	[]
/src/hostap/src/ap/wpa_auth_glue.c	[]	[]
/src/hostap/src/crypto/sha256-internal.c	['tls-server', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-server', 'tls-client', 'p2p']
/src/hostap/tests/fuzzing/tls-server/../../../src/utils/wpa_debug.h	['tls-server']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c	['wnm']	[]
/src/hostap/src/rsn_supp/./wpa_i.h	['eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/ap-mgmt/ap-mgmt.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/common.h	['eap-sim-peer']	[]
/src/hostap/src/crypto/rc4.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-client']
/src/hostap/src/wps/wps.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c	['sae']	[]
/src/hostap/src/p2p/../utils/wpabuf.h	['p2p']	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/wpabuf.h	['eap-sim-peer']	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/os.h	['json']	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/sha1-prf.c	[]	['eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/crypto/sha1.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-client', 'eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/ap/./ap_config.h	['ap-mgmt']	[]
/src/hostap/src/crypto/sha512-internal.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/sha512-kdf.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/sae.c	['pasn-resp']	['sae']
/src/hostap/src/ap/hw_features.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/radius/radius_client.c	['ap-mgmt']	[]
/src/hostap/src/wps/wps_common.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_auth.c	['dpp-uri']	[]
/src/hostap/src/p2p/p2p_parse.c	['p2p']	['p2p']
/src/hostap/src/ap/./preauth_auth.h	['ap-mgmt']	[]
/src/hostap/src/crypto/aes-internal.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-client', 'eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/common/./ieee802_11_common.h	['p2p', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/src/crypto/aes-internal-enc.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-client', 'eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/driver_i.h	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.c	['pasn-resp']	['eap-aka-peer', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha384-prf.c	['pasn-resp']	[]
/src/hostap/src/crypto/./aes_i.h	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../fuzzer-common.c	['eap-mschapv2-peer']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/wpabuf.h	['eap-aka-peer']	[]
/src/hostap/src/ap/../utils/list.h	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/src/ap/./sta_info.h	['ap-mgmt']	[]
/src/hostap/src/eapol_supp/eapol_supp_sm.c	['eapol-supp', 'eapol-key-supp', 'wnm']	['eapol-supp', 'eapol-key-supp']
/src/hostap/src/eap_server/../utils/wpabuf.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/pmksa_cache.c	['pasn-init']	['eapol-supp', 'eapol-key-supp']
/src/hostap/src/crypto/tls_internal.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client', 'eapol-supp']
/src/hostap/src/wps/wps_attr_parse.c	['p2p', 'ap-mgmt']	['p2p']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/crypto_openssl.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/common/gas_server.h	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/os.h	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha256-kdf.c	[]	[]
/src/hostap/src/radius/radius.c	['ap-mgmt', 'eapol-key-auth']	['ap-mgmt']
/src/hostap/tests/fuzzing/wnm/../../../src/utils/wpa_debug.h	['wnm']	[]
/src/hostap/src/crypto/crypto_internal-modexp.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/src/utils/../utils/os.h	['radius', 'dpp-uri', 'ap-mgmt', 'wnm']	[]
/src/hostap/src/ap/../utils/os.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c	['pasn-init']	['eapol-supp', 'eapol-key-supp']
/src/hostap/src/tls/./libtommath.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/src/ap/wpa_auth_ie.c	['ap-mgmt', 'eapol-key-auth']	['eapol-key-auth']
/src/hostap/tests/fuzzing/asn1/../../../src/utils/common.c	[]	['x509', 'sae', 'tls-server', 'radius', 'dpp-uri', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/crypto/sha1-prf.c	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/p2p/p2p_go_neg.c	['p2p']	['p2p']
/src/hostap/src/tls/x509v3.c	['x509', 'tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['x509', 'tls-server', 'tls-client']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/common.h	['pasn-resp']	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c	['eap-mschapv2-peer']	[]
/src/hostap/src/ap/ap_config.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/autoscan.h	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/rrm.c	['wnm']	[]
/src/hostap/src/crypto/sha1-pbkdf2.c	['tls-server', 'ap-mgmt', 'wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wmm_ac.c	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/config.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-resp/pasn-resp.c	['pasn-resp']	['pasn-resp']
/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpabuf.h	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/aes-ctr.c	['dpp-uri']	[]
/src/hostap/src/ap/sta_info.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/tls/pkcs8.c	['tls-server']	['tls-server']
/src/hostap/src/ap/authsrv.c	[]	[]
/src/hostap/tests/fuzzing/eapol-supp/eapol-supp.c	['eapol-supp']	['eapol-supp']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_tcp.c	['dpp-uri']	[]
/usr/include/openssl/x509.h	['dpp-uri']	[]
/src/hostap/src/tls/pkcs1.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/src/eapol_auth/eapol_auth_sm.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/scan.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha256-prf.c	['pasn-init']	[]
/src/hostap/src/crypto/md4-internal.c	[]	[]
/src/hostap/src/ap/vlan.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/x509/x509.c	['x509']	['x509']
/src/hostap/src/common/wpa_common.c	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/crypto/sha256-tlsprf.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/src/crypto/aes-internal-dec.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-client', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/utils/./list.h	['dpp-uri', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/json/../fuzzer-common.c	['json']	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/base64.c	[]	['tls-server', 'dpp-uri']
/src/hostap/src/ap/pmksa_cache_auth.c	['ap-mgmt', 'eapol-key-auth']	['eapol-key-auth']
/src/hostap/src/eap_common/../utils/wpabuf.h	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/dbus/dbus_new.h	['wnm']	[]
/src/hostap/src/tls/asn1.c	['x509', 'tls-server', 'tls-client']	['x509', 'tls-server', 'tls-client']
/src/hostap/tests/fuzzing/wnm/../../../src/common/defs.h	['wnm']	[]
/src/hostap/src/ap/bss_load.c	[]	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_common/eap_common.c	[]	['eapol-supp']
/src/hostap/src/wps/ndef.c	[]	[]
/src/hostap/tests/fuzzing/eapol-key-auth/eapol-key-auth.c	['eapol-key-auth']	['eapol-key-auth']
/src/hostap/tests/fuzzing/tls-client/tls-client.c	['tls-client']	['tls-client']
/src/hostap/src/crypto/sha384-internal.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/src/tls/tlsv1_server_write.c	['tls-server']	[]
/src/hostap/src/crypto/aes-omac1.c	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['eapol-supp', 'eapol-key-supp']
/src/hostap/src/ap/./hostapd.h	[]	[]
/src/hostap/src/ap/ieee802_11_shared.c	['ap-mgmt']	[]
/src/hostap/src/ap/./acs.h	[]	[]
/src/hostap/src/ap/tkip_countermeasures.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/sme.h	['wnm']	[]
/src/hostap/src/ap/ieee802_11.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/common/../utils/wpabuf.h	['sae', 'dpp-uri', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/tls/asn1.c	['dpp-uri']	['x509', 'tls-server', 'tls-client']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/events.c	['wnm']	[]
/src/hostap/src/tls/pkcs5.c	['tls-server']	[]
/src/hostap/src/ap/./ap_drv_ops.h	['ap-mgmt']	[]
/src/hostap/src/common/../utils/list.h	['ap-mgmt', 'wnm']	[]
/src/hostap/tests/fuzzing/asn1/../../../src/tls/asn1.h	['asn1']	[]
/src/hostap/src/utils/config.c	[]	[]
/src/hostap/src/ap/dfs.c	['ap-mgmt']	[]
/src/hostap/src/rsn_supp/../utils/wpabuf.h	[]	[]
/src/hostap/tests/fuzzing/pasn-init/../fuzzer-common.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/wpabuf.h	['wnm']	[]
/src/hostap/tests/fuzzing/sae/../../../src/common/dragonfly.c	['sae']	[]
/src/hostap/src/wps/wps_registrar.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/hs20_supplicant.c	['wnm']	[]
/src/hostap/src/p2p/../utils/list.h	['p2p']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/common.h	['wnm']	[]
/src/hostap/src/crypto/ms_funcs.c	[]	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c	['asn1']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c	['pasn-init']	['eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/wps/wps_enrollee.c	[]	[]
/src/hostap/src/crypto/fips_prf_internal.c	[]	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['radius', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/eapol-key-auth/../../../src/drivers/driver_common.c	[]	[]
/src/hostap/tests/fuzzing/radius/../../../src/utils/wpa_debug.h	['radius']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/dragonfly.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/crypto_openssl.c	['pasn-init']	[]
/src/hostap/src/ap/../common/defs.h	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/src/p2p/p2p.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c	['eap-sim-peer']	[]
/src/hostap/src/ap/neighbor_db.c	[]	[]
/src/hostap/src/ap/hs20.c	['ap-mgmt']	[]
/src/hostap/src/tls/../utils/os.h	['x509', 'tls-server', 'tls-client']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/pasn_initiator.c	['pasn-init']	[]
/src/hostap/src/eap_peer/eap.c	['eapol-supp', 'eapol-key-supp', 'wnm']	['eapol-supp']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_crypto.c	['dpp-uri']	[]
/src/hostap/src/crypto/md5.c	['tls-server', 'radius', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['radius', 'tls-client']
/src/hostap/src/tls/tlsv1_client_read.c	['tls-client']	['tls-client']
/src/hostap/src/wps/wps_attr_build.c	['p2p', 'ap-mgmt']	['p2p']
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha384-prf.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/ap-mgmt/../../../src/drivers/driver_common.c	[]	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_common/eap_sim_common.c	[]	[]
/src/hostap/tests/fuzzing/wnm/wnm.c	['wnm']	['wnm']
/src/hostap/tests/fuzzing/json/json.c	['json']	['json']
/src/hostap/src/l2_packet/../utils/common.h	['eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/src/tls/tlsv1_server_read.c	['tls-server']	[]
/src/hostap/src/wps/./wps.h	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_reconfig.c	['dpp-uri']	[]
/src/hostap/src/eap_peer/../utils/os.h	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/eloop.c	['pasn-resp']	['p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/ap/vlan_ifconfig.c	['ap-mgmt']	[]
/src/hostap/src/wps/../utils/common.h	['p2p', 'ap-mgmt']	[]
/src/hostap/src/ap/ap_mlme.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_common.c	[]	['eapol-supp']
/src/hostap/src/ap/./fils_hlp.h	[]	[]
/src/hostap/src/rsn_supp/tdls.c	['eapol-key-supp', 'wnm']	['eapol-key-supp']
/src/hostap/src/crypto/sha1-tlsprf.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/offchannel.c	['wnm']	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/wpa_debug.c	['json']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/gas_query.c	['wnm']	[]
/src/hostap/src/eap_server/eap_server_methods.c	['ap-mgmt']	[]
/src/hostap/src/common/sae.c	['sae']	['sae']
/src/hostap/src/ap/eap_user_db.c	[]	[]
/src/hostap/src/wps/wps_attr_process.c	[]	[]
/src/hostap/src/crypto/sha1-internal.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/utils/bitfield.c	['wnm']	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/common.h	[]	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/sha256-prf.c	[]	[]
/src/hostap/tests/fuzzing/ap-mgmt/../fuzzer-common.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c	['pasn-init']	['dpp-uri', 'p2p', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/wps/../utils/wpabuf.h	['p2p', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/ctrl_iface.h	[]	[]
/src/hostap/src/common/gas.c	['dpp-uri', 'p2p', 'wnm']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_pkex.c	['dpp-uri']	[]
/src/hostap/src/rsn_supp/wpa.c	['eapol-supp', 'eapol-key-supp', 'wnm']	['eapol-supp', 'eapol-key-supp', 'wnm']
/src/hostap/src/eap_server/eap_server.c	['ap-mgmt']	[]
/src/hostap/src/ap/wpa_auth.c	['ap-mgmt', 'eapol-key-auth']	['ap-mgmt', 'eapol-key-auth']
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_sim_common.h	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.c	['pasn-resp']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/list.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha1-prf.c	[]	['eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/tests/fuzzing/dpp-uri/dpp-uri.c	['dpp-uri']	['dpp-uri']
/src/hostap/tests/fuzzing/eapol-supp/../fuzzer-common.c	['eapol-supp']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/wpa_common.c	['pasn-resp']	['eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/common/ieee802_11_common.c	['dpp-uri', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['dpp-uri', 'p2p', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/wpa_debug.h	['eap-aka-peer']	[]
/src/hostap/src/radius/../utils/os.h	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/os_unix.c	['pasn-init']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/radius/../../../src/utils/wpabuf.h	['radius']	[]
/src/hostap/tests/fuzzing/dpp-uri/../fuzzer-common.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_backup.c	['dpp-uri']	[]
/src/hostap/src/ap/wpa_auth_ft.c	['ap-mgmt', 'eapol-key-auth']	['eapol-key-auth']
/src/hostap/src/utils/./os.h	['dpp-uri', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/aes-siv.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/eapol-key-auth/../fuzzer-common.c	['eapol-key-auth']	[]
/src/hostap/tests/fuzzing/radius/../../../src/radius/radius.c	['radius']	['ap-mgmt']
/src/hostap/src/p2p/p2p_build.c	['p2p']	['p2p']
/src/hostap/src/tls/../utils/common.h	['tls-server', 'tls-client']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/defs.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_common/eap_common.c	[]	['eapol-supp']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/sha256-kdf.c	['dpp-uri']	[]
/src/hostap/src/tls/tlsv1_server.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client', 'eapol-supp']
/src/hostap/tests/fuzzing/wnm/../fuzzer-common.c	['wnm']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/const_time.h	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.c	['pasn-resp']	['dpp-uri', 'p2p', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/json/../../../src/utils/os_unix.c	['json']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.h	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/list.h	['pasn-resp']	[]
/src/hostap/src/utils/uuid.c	[]	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/common.h	['eap-aka-peer']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/drivers/driver_common.c	['wnm']	[]
/src/hostap/src/rsn_supp/../common/defs.h	['eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.c	['pasn-init']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bss.c	['wnm']	[]
/src/hostap/src/ap/dhcp_snoop.c	[]	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/mschapv2.c	[]	[]
/src/hostap/tests/fuzzing/radius/../../../src/utils/common.h	['radius']	[]
/src/hostap/src/wps/../utils/list.h	[]	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/sae.c	['pasn-init']	['sae']
/src/hostap/src/crypto/crypto_internal-cipher.c	['tls-server', 'tls-client']	['tls-client']
/src/hostap/tests/fuzzing/eap-sim-peer/eap-sim-peer.c	['eap-sim-peer']	['eap-sim-peer']
/src/hostap/src/p2p/p2p_sd.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/pasn-init/pasn-init.c	['pasn-init']	['pasn-init']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/common.c	['pasn-resp']	['x509', 'sae', 'tls-server', 'radius', 'dpp-uri', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/utils/base64.c	['tls-server', 'dpp-uri', 'wnm']	['tls-server', 'dpp-uri']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/common.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/dh_groups.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.h	['pasn-resp']	[]
/src/hostap/src/ap/ieee802_11_ht.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/p2p_supplicant.h	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpas_kay.h	[]	[]
/src/hostap/src/utils/common.c	['x509', 'sae', 'tls-server', 'radius', 'dpp-uri', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['x509', 'sae', 'tls-server', 'radius', 'dpp-uri', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/ap/ieee802_11_auth.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/ap/ieee802_1x.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/p2p/p2p_utils.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/sae/sae.c	['sae']	['sae']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bss.h	['wnm']	[]
/src/hostap/tests/fuzzing/radius/../fuzzer-common.c	['radius']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/dragonfly.c	['pasn-resp']	[]
/src/hostap/src/eap_common/../utils/common.h	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm']	[]
/src/hostap/src/ap/accounting.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/crypto/../utils/wpa_debug.h	[]	[]
/src/hostap/src/crypto/../utils/common.h	['tls-server', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/src/ap/utils.c	['ap-mgmt']	[]
/src/hostap/src/utils/os_unix.c	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/json/../../../src/utils/json.c	['json']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/interworking.c	['wnm']	[]
/src/hostap/src/utils/wpabuf.c	['eap-aka-peer', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['eap-aka-peer', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/tls/tlsv1_client.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client', 'eapol-supp']
/src/hostap/src/tls/rsa.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bgscan.h	['wnm']	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpabuf.c	[]	['eap-aka-peer', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/src/crypto/dh_groups.c	[]	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/os.h	['asn1']	[]
/src/hostap/src/utils/wpa_debug.c	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha256-prf.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/common.c	['pasn-init']	['x509', 'sae', 'tls-server', 'radius', 'dpp-uri', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha1-prf.c	[]	['eapol-supp', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/p2p/p2p_pd.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha384-kdf.c	[]	[]
/src/hostap/src/crypto/milenage.c	[]	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/os_unix.c	['asn1']	['eap-aka-peer', 'x509', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpa_debug.h	['eap-mschapv2-peer']	[]
/src/hostap/src/ap/wps_hostapd.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpabuf.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/crypto_openssl.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/sae/../../../src/utils/wpa_debug.h	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/wpa_debug.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/robust_av.c	['wnm']	[]
/src/hostap/src/crypto/crypto_internal.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client', 'eapol-supp']
/src/hostap/src/utils/json.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/op_classes.c	['wnm']	[]
/src/hostap/src/p2p/p2p_group.c	['p2p']	[]
/src/hostap/src/rsn_supp/../rsn_supp/wpa_i.h	['eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../fuzzer-common.c	['eap-aka-peer']	[]
/src/hostap/src/rsn_supp/../utils/common.h	['eapol-supp', 'eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.h	['wnm']	[]
/src/hostap/src/crypto/aes-siv.c	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant_i.h	['wnm']	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/common.h	['eap-mschapv2-peer']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha384-kdf.c	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../fuzzer-common.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/eapol-key-supp/eapol-key-supp.c	['eapol-key-supp']	['eapol-key-supp']
/src/hostap/src/ap/./ieee802_11.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpas_glue.c	['wnm']	[]
/src/hostap/src/p2p/../utils/os.h	['p2p']	[]
/src/hostap/src/tls/tlsv1_record.c	['tls-server', 'tls-client']	['tls-server', 'tls-client']
/src/hostap/src/eap_common/eap_common.c	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm']	['eapol-supp']
/src/hostap/src/ap/hostapd.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bssid_ignore.c	['wnm']	[]
/src/hostap/src/utils/./wpabuf.h	['eap-aka-peer', 'eap-sim-peer', 'sae', 'tls-server', 'radius', 'dpp-uri', 'eap-mschapv2-peer', 'tls-client', 'p2p', 'eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.h	['pasn-resp']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/tls/asn1.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c	['eap-aka-peer']	[]
/src/hostap/src/ap/wmm.c	['ap-mgmt']	[]
/src/hostap/src/p2p/p2p_dev_disc.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c	['asn1']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/defs.h	['pasn-resp']	[]
/src/hostap/tests/fuzzing/radius/radius.c	['radius']	['radius']
/src/hostap/src/ap/./wpa_auth.h	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/src/radius/radius_das.c	[]	[]
/src/hostap/src/radius/./radius.h	[]	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../fuzzer-common.c	['eap-sim-peer']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/ap/comeback_token.c	['pasn-resp']	[]
/src/hostap/src/common/hw_features_common.c	['ap-mgmt', 'wnm']	[]
/src/hostap/src/crypto/sha256-prf.c	['eapol-supp', 'eapol-key-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth']	[]
/src/hostap/src/ap/ap_list.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/wpabuf.h	[]	[]
/src/hostap/src/ap/../utils/wpabuf.h	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/src/crypto/crypto_internal-rsa.c	['tls-server', 'tls-client', 'eapol-supp', 'eapol-key-supp', 'wnm']	['tls-server', 'tls-client']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/sha384-kdf.c	['dpp-uri']	[]
/src/hostap/src/tls/./asn1.h	['x509', 'tls-server', 'tls-client']	[]
/src/hostap/src/crypto/aes-encblock.c	[]	[]
/src/hostap/src/ap/gas_serv.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/radius/../../../src/utils/os.h	['radius']	[]
/src/hostap/src/crypto/aes-wrap.c	['ap-mgmt', 'eapol-key-auth']	['eapol-key-auth']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/wpabuf.h	['dpp-uri']	[]
/src/hostap/src/ap/../utils/common.h	['ap-mgmt', 'eapol-key-auth']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/mesh_mpm.h	['wnm']	[]

Directories in report

Directory
/src/hostap/src/crypto/../utils/
/src/hostap/src/eap_server/../utils/
/src/hostap/src/utils/../utils/
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/
/src/hostap/src/utils/./
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/
/src/hostap/tests/fuzzing/json/../../../src/utils/
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_common/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/
/src/hostap/src/p2p/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/
/src/hostap/tests/fuzzing/sae/
/src/hostap/src/eap_common/../utils/
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/
/src/hostap/tests/fuzzing/pasn-resp/../../../src/ap/
/src/hostap/src/radius/./
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/
/src/hostap/src/tls/
/src/hostap/src/eap_peer/
/src/hostap/src/rsn_supp/../common/
/src/hostap/src/ap/../wps/
/src/hostap/tests/fuzzing/json/../
/src/hostap/tests/fuzzing/pasn-init/
/src/hostap/tests/fuzzing/asn1/../../../src/utils/
/src/hostap/tests/fuzzing/tls-client/../
/src/hostap/src/eap_peer/../utils/
/src/hostap/tests/fuzzing/asn1/../../../src/tls/
/src/hostap/src/utils/
/src/hostap/tests/fuzzing/wnm/../../../src/eap_peer/
/src/hostap/src/crypto/./
/src/hostap/tests/fuzzing/wnm/../../../src/utils/
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/
/src/hostap/tests/fuzzing/tls-client/../../../src/utils/
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/
/src/hostap/src/rsn_supp/../utils/
/src/hostap/tests/fuzzing/tls-client/
/src/hostap/tests/fuzzing/json/
/src/hostap/tests/fuzzing/x509/../
/src/hostap/tests/fuzzing/pasn-init/../../../src/eapol_supp/
/src/hostap/tests/fuzzing/wnm/../../../src/drivers/
/src/hostap/src/eapol_auth/
/src/hostap/src/ap/../common/
/src/hostap/tests/fuzzing/eapol-key-auth/../../../src/drivers/
/src/hostap/tests/fuzzing/eapol-key-auth/../
/src/hostap/tests/fuzzing/asn1/../
/src/hostap/tests/fuzzing/dpp-uri/
/src/hostap/tests/fuzzing/eapol-key-supp/../
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/
/src/hostap/tests/fuzzing/pasn-init/../
/src/hostap/src/rsn_supp/./
/src/hostap/src/ap/../radius/
/src/hostap/src/eap_server/
/src/hostap/src/common/
/src/hostap/tests/fuzzing/asn1/
/src/hostap/tests/fuzzing/ap-mgmt/../../../src/drivers/
/src/hostap/tests/fuzzing/eapol-supp/../
/src/hostap/tests/fuzzing/ap-mgmt/
/src/hostap/src/rsn_supp/../rsn_supp/
/src/hostap/tests/fuzzing/ap-mgmt/../
/src/hostap/tests/fuzzing/eapol-key-auth/
/src/hostap/tests/fuzzing/eap-aka-peer/
/src/hostap/tests/fuzzing/tls-server/
/src/hostap/src/p2p/../utils/
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/
/src/hostap/src/tls/./
/src/hostap/tests/fuzzing/sae/../../../src/common/
/src/hostap/src/crypto/
/usr/include/x86_64-linux-gnu/bits/
/src/hostap/tests/fuzzing/dpp-uri/../
/src/hostap/src/ap/./
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/dbus/
/src/hostap/tests/fuzzing/eapol-key-supp/
/src/hostap/tests/fuzzing/sae/../
/src/hostap/tests/fuzzing/wnm/../../../src/common/
/src/hostap/src/wps/../utils/
/src/hostap/src/common/./
/src/hostap/tests/fuzzing/tls-server/../../../src/utils/
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/
/src/hostap/tests/fuzzing/radius/
/src/hostap/tests/fuzzing/tls-server/../
/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/
/src/hostap/tests/fuzzing/x509/
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/
/src/hostap/tests/fuzzing/wnm/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_common/
/src/hostap/src/common/../utils/
/src/hostap/tests/fuzzing/radius/../../../src/utils/
/src/hostap/tests/fuzzing/eap-sim-peer/
/src/hostap/tests/fuzzing/eapol-supp/
/src/hostap/tests/fuzzing/dpp-uri/../../../src/tls/
/src/hostap/src/wps/
/src/hostap/tests/fuzzing/radius/../../../src/radius/
/src/hostap/src/radius/../utils/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../
/src/hostap/src/l2_packet/
/src/hostap/tests/fuzzing/p2p/
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/
/src/hostap/tests/fuzzing/sae/../../../src/crypto/
/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/
/src/hostap/src/wps/./
/src/hostap/src/rsn_supp/
/src/hostap/tests/fuzzing/sae/../../../src/utils/
/src/hostap/tests/fuzzing/pasn-resp/
/src/hostap/tests/fuzzing/eap-sim-peer/../
/src/hostap/src/ap/../utils/
/usr/include/openssl/
/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/
/src/hostap/tests/fuzzing/radius/../
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/
/src/hostap/src/l2_packet/../utils/
/src/hostap/tests/fuzzing/p2p/../
/src/hostap/src/eapol_supp/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/
/src/hostap/src/eap_common/
/src/hostap/src/tls/../utils/
/src/hostap/src/ap/
/src/hostap/tests/fuzzing/eap-aka-peer/../
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/
/src/hostap/tests/fuzzing/wnm/../
/src/hostap/tests/fuzzing/pasn-resp/../
/src/hostap/src/radius/