High level conclusions

Fuzzers reach 63.30% of cyclomatic complexity.

Fuzzers reach 57.81% of all functions.

Fuzzer ap-mgmt is blocked:

The runtime code coverage of ap-mgmt covers 10.20% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer wnm is blocked:

The runtime code coverage of wnm covers 6.099% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dpp-uri is blocked:

The runtime code coverage of dpp-uri covers 10.08% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer tls-server is blocked:

The runtime code coverage of tls-server covers 29.80% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pasn-init is blocked:

The runtime code coverage of pasn-init covers 1.749% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pasn-resp is blocked:

The runtime code coverage of pasn-resp covers 26.57% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3393 / 5869

Cyclomatic complexity statically reachable by fuzzers

27368 / 43232

Runtime code coverage of functions

1215 / 5869

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	29	34.1%
gold	[1:9]	9	10.5%
yellow	[10:29]	5	5.88%
greenyellow	[30:49]	1	1.17%
lawngreen	50+	41	48.2%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	67	wpa_hexdump_ascii	call site: 00067	wpa_debug_print_timestamp
7	5	asn1_parse	call site: 00005	wpa_printf
6	39	wpa_hexdump	call site: 00039	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi
1	35	asn1_parse	call site: 00035	wpa_printf
1	47	asn1_parse	call site: 00047	wpa_printf

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

9

Reachable functions

28

Percentage of reachable functions covered

67.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/asn1/asn1.c	3
tests/fuzzing/asn1/../fuzzer-common.c	1
tests/fuzzing/asn1/../../../src/tls/asn1.c	8
tests/fuzzing/asn1/../../../src/utils/wpa_debug.c	6
tests/fuzzing/asn1/../../../src/utils/os_unix.c	1
tests/fuzzing/asn1/../../../src/tls/asn1.h	1
tests/fuzzing/asn1/../../../src/utils/os.h	1

Fuzzer: json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	9.21%
gold	[1:9]	4	5.26%
yellow	[10:29]	7	9.21%
greenyellow	[30:49]	2	2.63%
lawngreen	50+	56	73.6%
All colors	76	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	6	json_alloc_token	call site: 00006	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

13

Reachable functions

32

Percentage of reachable functions covered

59.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/json/json.c	1
tests/fuzzing/json/../fuzzer-common.c	1
tests/fuzzing/json/../../../src/utils/json.c	11
tests/fuzzing/json/../../../src/utils/wpa_debug.c	2
tests/fuzzing/json/../../../src/utils/os_unix.c	2
tests/fuzzing/json/../../../src/utils/common.c	3
tests/fuzzing/json/../../../src/utils/os.h	1

Fuzzer: eap-sim-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	1	2.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	50.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	18	wpabuf_put	call site: 00018	wpabuf_overflow
11	35	wpa_hexdump	call site: 00035	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

12

Reachable functions

32

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-sim-peer/eap-sim-peer.c	3
tests/fuzzing/eap-sim-peer/../fuzzer-common.c	1
tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c	1
src/utils/os_unix.c	2
tests/fuzzing/eap-sim-peer/../../../src/utils/common.h	1
src/utils/wpabuf.c	5
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/eap-sim-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-sim-peer/../../../src/utils/wpabuf.h	2

Fuzzer: eap-aka-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	1	2.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	50.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	18	wpabuf_put	call site: 00018	wpabuf_overflow
11	35	wpa_hexdump	call site: 00035	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

12

Reachable functions

32

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-aka-peer/eap-aka-peer.c	3
tests/fuzzing/eap-aka-peer/../fuzzer-common.c	1
tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c	1
src/utils/os_unix.c	2
tests/fuzzing/eap-aka-peer/../../../src/utils/common.h	1
src/utils/wpabuf.c	5
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/eap-aka-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-aka-peer/../../../src/utils/wpabuf.h	2

Fuzzer: eap-mschapv2-peer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	48.0%
gold	[1:9]	1	2.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	50.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	18	wpabuf_put	call site: 00018	wpabuf_overflow
11	35	wpa_hexdump	call site: 00035	wpa_debug_print_timestamp
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

90

Functions that are reachable but not covered

12

Reachable functions

32

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eap-mschapv2-peer/eap-mschapv2-peer.c	3
tests/fuzzing/eap-mschapv2-peer/../fuzzer-common.c	1
tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c	1
src/utils/os_unix.c	2
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/common.h	1
src/utils/wpabuf.c	5
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpa_debug.h	1
tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpabuf.h	2

Fuzzer: ml-elems

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	19	14.2%
gold	[1:9]	1	0.75%
yellow	[10:29]	1	0.75%
greenyellow	[30:49]	1	0.75%
lawngreen	50+	111	83.4%
All colors	133	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6	9	ieee802_11_parse_ext_len_elem	call site: 00009	wpa_debug_print_timestamp
6	48	wpa_hexdump	call site: 00048	wpa_debug_print_timestamp
3	65	wpabuf_put	call site: 00065	wpabuf_overflow
2	70	ieee802_11_defrag	call site: 00070	wpabuf_alloc
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi
1	73	wpabuf_resize	call site: 00073	wpabuf_free

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

11

Reachable functions

54

Percentage of reachable functions covered

79.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/ml-elems/ml-elems.c	2
tests/fuzzing/ml-elems/../fuzzer-common.c	1
tests/fuzzing/ml-elems/../../../src/common/ieee802_11_common.c	19
tests/fuzzing/ml-elems/../../../src/common/ieee802_11_common.h	5
tests/fuzzing/ml-elems/../../../src/utils/wpa_debug.c	4
tests/fuzzing/ml-elems/../../../src/utils/os_unix.c	2
tests/fuzzing/ml-elems/../../../src/utils/common.h	2
tests/fuzzing/ml-elems/../../../src/utils/wpabuf.c	6
tests/fuzzing/ml-elems/../../../src/utils/wpabuf.h	5

Fuzzer: sae

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	110	43.4%
gold	[1:9]	4	1.58%
yellow	[10:29]	3	1.18%
greenyellow	[30:49]	16	6.32%
lawngreen	50+	120	47.4%
All colors	253	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	119	sae_parse_commit	call site: 00119	sae_parse_commit_element_ffc
25	187	wpa_hexdump_ascii	call site: 00187	wpa_debug_print_timestamp
11	91	wpa_hexdump	call site: 00091	wpa_debug_print_timestamp
10	10	sae_group_allowed	call site: 00010	wpa_printf
5	80	crypto_bignum_init_set	call site: 00080	sae_clear_data
4	74	sae_set_group	call site: 00074	sae_clear_data
4	242	sae_parse_commit	call site: 00242	crypto_bignum_cmp
3	166	crypto_ec_point_from_bin	call site: 00166	BN_clear_free
3	182	sae_parse_password_identifier	call site: 00182	wpa_printf
3	224	wpabuf_put	call site: 00224	wpabuf_overflow
2	107	crypto_bignum_cmp	call site: 00107	wpa_printf
2	152	crypto_bignum_to_bin	call site: 00152	BN_num_bits

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

45

Reachable functions

105

Percentage of reachable functions covered

57.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/sae/sae.c	1
tests/fuzzing/sae/../fuzzer-common.c	1
src/utils/os_unix.c	5
src/common/sae.c	18
src/common/../utils/common.h	2
src/utils/wpa_debug.c	6
tests/fuzzing/sae/../../../src/common/dragonfly.c	1
tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c	20
src/utils/wpabuf.c	4
src/utils/common.c	2
tests/fuzzing/sae/../../../src/crypto/dh_groups.c	1
tests/fuzzing/sae/../../../src/utils/os.h	1
src/common/../utils/wpabuf.h	3
src/utils/./wpabuf.h	3
src/common/../utils/wpa_debug.h	1
src/common/../common/defs.h	1

Fuzzer: x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	15.2%
gold	[1:9]	22	6.19%
yellow	[10:29]	26	7.32%
greenyellow	[30:49]	17	4.78%
lawngreen	50+	236	66.4%
All colors	355	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	105	wpa_hexdump_ascii	call site: 00105	wpa_debug_print_timestamp
11	45	wpa_hexdump	call site: 00045	wpa_debug_print_timestamp
9	8	asn1_get_next	call site: 00008	wpa_debug_print_timestamp
2	350	x509_certificate_parse	call site: 00350	x509_certificate_free
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi
1	39	x509_certificate_parse	call site: 00039	wpa_printf
1	42	x509_certificate_free	call site: 00042	x509_certificate_free
1	101	x509_parse_name	call site: 00101	x509_free_name
1	133	x509_parse_name	call site: 00133	x509_free_name
1	160	x509_parse_time	call site: 00160	wpa_printf
1	199	x509_parse_public_key	call site: 00199	wpa_printf

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

17

Reachable functions

91

Percentage of reachable functions covered

81.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/x509/x509.c	1
tests/fuzzing/x509/../fuzzer-common.c	1
src/tls/x509v3.c	40
src/utils/os_unix.c	5
src/tls/asn1.c	10
src/utils/wpa_debug.c	6
src/tls/./asn1.h	11
src/utils/common.c	1
src/tls/../utils/os.h	1

Fuzzer: pasn-resp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	879	77.9%
gold	[1:9]	59	5.23%
yellow	[10:29]	61	5.41%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	128	11.3%
All colors	1127	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
439	356	bin_clear_free	call site: 00356	sae_parse_commit
199	807	handle_auth_pasn_resp	call site: 00807	pasn_get_wrapped_data
45	1063	handle_auth_pasn_3	call site: 01063	pasn_parse_encrypted_data
41	314	handle_auth_pasn_1	call site: 00314	pasn_wd_handle_sae_commit
34	187	wpabuf_put_u8	call site: 00187	wpa_pasn_add_parameter_ie
28	1034	handle_auth_pasn_3	call site: 01034	pasn_auth_frame_hash
7	8	eloop_init	call site: 00008	wpa_printf
7	176	os_get_reltime	call site: 00176	wpabuf_put_le16
6	66	wpa_hexdump	call site: 00066	wpa_debug_print_timestamp
5	152	openssl_hmac_vector	call site: 00152	hmac_sha256_vector
5	169	wpabuf_put	call site: 00169	auth_build_token_req
5	1012	handle_auth_pasn_resp	call site: 01012	wpa_printf

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

221

Reachable functions

301

Percentage of reachable functions covered

26.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/pasn-resp/pasn-resp.c	3
tests/fuzzing/pasn-resp/../fuzzer-common.c	1
tests/fuzzing/pasn-resp/../../../src/utils/os_unix.c	8
tests/fuzzing/pasn-resp/../../../src/utils/eloop.c	4
tests/fuzzing/pasn-resp/../../../src/utils/list.h	2
tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.c	7
tests/fuzzing/pasn-resp/../../../src/pasn/pasn_common.c	3
tests/fuzzing/pasn-resp/../../../src/utils/common.c	7
tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c	11
tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.c	9
tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.h	5
tests/fuzzing/pasn-resp/../../../src/utils/common.h	7
tests/fuzzing/pasn-resp/../../../src/common/wpa_common.c	28
tests/fuzzing/pasn-resp/../../../src/ap/comeback_token.c	3
tests/fuzzing/pasn-resp/../../../src/crypto/crypto_openssl.c	46
tests/fuzzing/pasn-resp/../../../src/utils/os.h	4
tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.c	7
tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.h	10
tests/fuzzing/pasn-resp/../../../src/common/sae.c	40
tests/fuzzing/pasn-resp/../../../src/common/dragonfly.c	3
tests/fuzzing/pasn-resp/../../../src/crypto/dh_groups.c	1
tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.h	1
tests/fuzzing/pasn-resp/../../../src/common/defs.h	3
tests/fuzzing/pasn-resp/../../../src/crypto/sha256-prf.c	2
tests/fuzzing/pasn-resp/../../../src/crypto/sha384-prf.c	2

Fuzzer: radius

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	29.2%
gold	[1:9]	1	0.53%
yellow	[10:29]	4	2.12%
greenyellow	[30:49]	2	1.06%
lawngreen	50+	126	67.0%
All colors	188	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	20	wpabuf_put	call site: 00020	wpabuf_overflow
11	164	wpa_hexdump	call site: 00164	wpa_debug_print_timestamp
5	50	radius_msg_add_attr	call site: 00050	wpabuf_resize
4	56	radius_msg_add_attr	call site: 00056	wpabuf_put_data
3	67	radius_msg_add_attr	call site: 00067	wpabuf_put_data
3	93	hmac_md5_vector	call site: 00093	wpa_printf
2	42	radius_msg_add_attr	call site: 00042	wpa_printf
2	97	radius_msg_finish	call site: 00097	wpa_printf
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi
1	14	os_calloc	call site: 00014	radius_msg_free
1	36	radius_msg_auth_pos	call site: 00036	radius_get_attr_hdr
1	45	radius_msg_add_attr	call site: 00045	wpa_printf

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

21

Reachable functions

83

Percentage of reachable functions covered

74.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/radius/radius.c	1
tests/fuzzing/radius/../fuzzer-common.c	1
src/utils/os_unix.c	6
tests/fuzzing/radius/../../../src/radius/radius.c	23
src/utils/wpabuf.c	6
tests/fuzzing/radius/../../../src/utils/os.h	3
src/utils/./wpabuf.h	4
src/utils/wpa_debug.c	4
tests/fuzzing/radius/../../../src/utils/wpabuf.h	8
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/../utils/os.h	1
src/utils/common.c	4
src/utils/../utils/os.h	1
tests/fuzzing/radius/../../../src/utils/common.h	2
tests/fuzzing/radius/../../../src/utils/wpa_debug.h	1

Fuzzer: pasn-init

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1317	99.3%
gold	[1:9]	7	0.52%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.07%
All colors	1325	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1316	8	eloop_init	call site: 00008	wpa_pasn_auth_rx
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

6

Functions that are reachable but not covered

337

Reachable functions

343

Percentage of reachable functions covered

1.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/pasn-init/pasn-init.c	1
tests/fuzzing/pasn-init/../fuzzer-common.c	1
tests/fuzzing/pasn-init/../../../src/utils/os_unix.c	7
tests/fuzzing/pasn-init/../../../src/utils/eloop.c	6
tests/fuzzing/pasn-init/../../../src/utils/list.h	4
tests/fuzzing/pasn-init/../../../src/rsn_supp/pmksa_cache.c	13
tests/fuzzing/pasn-init/../../../src/pasn/pasn_initiator.c	23
tests/fuzzing/pasn-init/../../../src/utils/common.c	7
tests/fuzzing/pasn-init/../../../src/common/dragonfly.c	3
tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.c	7
tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c	10
tests/fuzzing/pasn-init/../../../src/crypto/crypto_openssl.c	47
tests/fuzzing/pasn-init/../../../src/utils/wpabuf.c	7
tests/fuzzing/pasn-init/../../../src/utils/wpabuf.h	10
tests/fuzzing/pasn-init/../../../src/utils/os.h	2
tests/fuzzing/pasn-init/../../../src/common/wpa_common.c	35
tests/fuzzing/pasn-init/../../../src/utils/common.h	6
tests/fuzzing/pasn-init/../../../src/common/defs.h	6
tests/fuzzing/pasn-init/../../../src/common/sae.c	40
tests/fuzzing/pasn-init/../../../src/crypto/dh_groups.c	1
tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.h	1
tests/fuzzing/pasn-init/../../../src/eapol_supp/eapol_supp_sm.h	5
tests/fuzzing/pasn-init/../../../src/pasn/pasn_common.h	1
tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.h	5
tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c	1
tests/fuzzing/pasn-init/../../../src/crypto/sha256-prf.c	2
tests/fuzzing/pasn-init/../../../src/crypto/sha384-prf.c	2
tests/fuzzing/pasn-init/../../../src/common/wpa_common.h	2
tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_i.h	2
tests/fuzzing/pasn-init/../../../src/pasn/pasn_common.c	1

Fuzzer: tls-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	681	38.4%
gold	[1:9]	87	4.91%
yellow	[10:29]	67	3.78%
greenyellow	[30:49]	81	4.57%
lawngreen	50+	853	48.2%
All colors	1769	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	1136	x509_certificate_chain_free	call site: 01136	tls_process_certificate_status_ocsp_response
63	1072	pkcs1_decrypt_public_key	call site: 01072	asn1_get_oid
57	813	x509_certificate_parse	call site: 00813	x509_certificate_check_signature
54	1344	tls_process_certificate	call site: 01344	x509_certificate_chain_validate
27	573	wpa_hexdump_ascii	call site: 00573	wpa_printf
24	1712	tlsv1_client_decrypt	call site: 01712	tlsv1_server_decrypt
23	421	tls_process_server_key_exchange	call site: 00421	tls_process_certificate_status
20	1565	tls_write_client_key_exchange	call site: 01565	tls_write_client_certificate_verify
18	1026	s_mp_exptmod	call site: 01026	bignum_exptmod
13	511	x509_parse_algorithm_identifier	call site: 00511	x509_certificate_parse
12	464	asn1_unexpected	call site: 00464	asn1_get_oid
12	1670	tls_connection_encrypt	call site: 01670	tlsv1_server_encrypt

Runtime coverage analysis

Covered functions

296

Functions that are reachable but not covered

88

Reachable functions

380

Percentage of reachable functions covered

76.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/tls-client/tls-client.c	2
tests/fuzzing/tls-client/../fuzzer-common.c	1
src/crypto/tls_internal.c	11
src/tls/tlsv1_client.c	14
src/crypto/crypto_internal.c	5
src/tls/tlsv1_server.c	11
src/utils/os_unix.c	7
src/tls/tlsv1_common.c	13
src/crypto/md5-internal.c	5
src/utils/common.c	4
src/crypto/sha1-internal.c	5
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/sha384-internal.c	4
src/crypto/sha512-internal.c	5
src/crypto/../utils/os.h	1
src/utils/wpa_debug.c	7
src/crypto/../utils/wpabuf.h	4
src/tls/tlsv1_client_write.c	13
src/tls/../utils/common.h	5
src/tls/tlsv1_record.c	5
src/crypto/crypto_internal-cipher.c	4
src/crypto/rc4.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/./aes_i.h	1
src/crypto/des-internal.c	9
src/utils/wpabuf.c	7
src/tls/../utils/wpabuf.h	4
src/utils/./wpabuf.h	4
src/crypto/aes-internal-dec.c	5
src/tls/tlsv1_client_read.c	17
src/crypto/sha256-tlsprf.c	1
src/crypto/sha256.c	2
src/crypto/sha1-tlsprf.c	1
src/crypto/md5.c	2
src/crypto/sha1.c	2
src/tls/tlsv1_client_ocsp.c	7
src/tls/asn1.c	10
src/tls/./asn1.h	13
src/tls/../utils/os.h	1
src/tls/x509v3.c	59
src/crypto/crypto_internal-rsa.c	7
src/tls/rsa.c	5
src/tls/bignum.c	11
src/tls/./libtommath.c	41
src/tls/pkcs1.c	3
src/crypto/aes-internal.c	1
src/crypto/crypto_internal-modexp.c	1
tests/fuzzing/tls-client/../../../src/utils/common.h	1
tests/fuzzing/tls-client/../../../src/utils/wpabuf.h	4
tests/fuzzing/tls-client/../../../src/utils/wpa_debug.h	1
src/tls/tlsv1_cred.c	1

Fuzzer: p2p

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1439	60.1%
gold	[1:9]	151	6.31%
yellow	[10:29]	72	3.00%
greenyellow	[30:49]	99	4.13%
lawngreen	50+	632	26.4%
All colors	2393	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
128	996	p2p_build_probe_resp_ies	call site: 00996	p2p_timeout_connect_listen
93	1404	p2p_peer_channels_check	call site: 01404	p2p_stop_find_for_freq
89	1241	p2p_reply_probe	call site: 01241	p2p_go_neg_start
89	1567	p2p_process_go_neg_resp	call site: 01567	p2p_go_neg_wait_timeout
79	394	p2p_clear_timeout	call site: 00394	p2p_state_timeout
47	771	wpabuf_mhead_u8	call site: 00771	p2p_send_action
47	2110	p2p_rx_gas_initial_resp	call site: 02110	p2p_sd_query_cb
40	1660	p2p_handle_go_neg_conf	call site: 01660	p2p_go_complete
39	2199	p2p_rx_gas_comeback_resp	call site: 02199	p2p_send_gas_comeback_req
37	2247	p2p_process_presence_req	call site: 02247	p2p_send_action
34	688	p2p_stop_listen_for_freq	call site: 00688	p2p_clear_timeout
34	2161	p2p_rx_gas_comeback_req	call site: 02161	p2p_send_action

Runtime coverage analysis

Covered functions

222

Functions that are reachable but not covered

173

Reachable functions

387

Percentage of reachable functions covered

55.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/p2p/p2p.c	3
tests/fuzzing/p2p/../fuzzer-common.c	1
src/utils/os_unix.c	7
src/utils/eloop.c	11
src/utils/./list.h	5
src/utils/wpa_debug.c	6
src/p2p/p2p.c	85
src/crypto/sha256-internal.c	5
src/crypto/../utils/os.h	1
src/crypto/../utils/common.h	3
src/p2p/../utils/list.h	3
src/p2p/p2p_utils.c	23
src/p2p/../utils/os.h	4
src/utils/./os.h	3
src/p2p/p2p_parse.c	8
src/common/ieee802_11_common.c	22
src/common/./ieee802_11_common.h	5
src/common/../utils/common.h	3
src/utils/wpabuf.c	8
src/common/../utils/wpabuf.h	8
src/utils/./wpabuf.h	6
src/wps/wps_attr_parse.c	5
src/wps/../utils/wpabuf.h	7
src/wps/../utils/common.h	5
src/wps/../utils/wpa_debug.h	1
src/p2p/../utils/common.h	12
src/wps/wps_common.c	1
src/wps/../utils/os.h	1
src/p2p/../utils/wpabuf.h	13
src/utils/common.c	7
src/p2p/../utils/wpa_debug.h	1
src/p2p/p2p_pd.c	22
src/p2p/p2p_build.c	36
src/p2p/p2p_sd.c	14
src/common/gas.c	11
src/p2p/p2p_go_neg.c	19
src/wps/wps_attr_build.c	3
src/p2p/p2p_invitation.c	6
src/p2p/p2p_group.c	8
src/p2p/p2p_dev_disc.c	5

Fuzzer: eapol-key-supp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1628	78.4%
gold	[1:9]	21	1.01%
yellow	[10:29]	18	0.86%
greenyellow	[30:49]	4	0.19%
lawngreen	50+	404	19.4%
All colors	2075	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
367	479	wpa_hexdump_ascii	call site: 00479	rsn_preauth_candidate_process
240	238	wpa_sm_notify_assoc	call site: 00238	rsn_preauth_deinit
90	1844	wpa_supplicant_process_3_of_4	call site: 01844	wpa_supplicant_key_neg_complete
73	1457	wpa_derive_ptk	call site: 01457	wpa_derive_ptk_ft
72	966	omac1_aes_128	call site: 00966	wpa_tdls_tpk_send
49	1730	wpa_supplicant_process_3_of_4	call site: 01730	wpa_supplicant_validate_link_kde
42	63	wpa_hexdump_key	call site: 00063	pmksa_cache_add
40	876	wpa_cipher_valid_group	call site: 00876	wpa_ft_mic
40	1630	aes_unwrap	call site: 01630	wpa_supplicant_key_neg_complete
37	1402	wpa_supplicant_get_pmk	call site: 01402	pmksa_cache_add
32	1285	wpa_supplicant_validate_ie	call site: 01285	wpa_supplicant_send_4_of_4
27	848	wpa_ft_is_completed	call site: 00848	wpa_supplicant_key_neg_complete

Runtime coverage analysis

Covered functions

172

Functions that are reachable but not covered

352

Reachable functions

515

Percentage of reachable functions covered

31.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-key-supp/eapol-key-supp.c	6
tests/fuzzing/eapol-key-supp/../fuzzer-common.c	1
src/utils/os_unix.c	9
src/utils/eloop.c	18
src/utils/./list.h	5
src/utils/wpa_debug.c	8
src/rsn_supp/wpa.c	82
src/rsn_supp/../utils/list.h	3
src/rsn_supp/pmksa_cache.c	14
src/utils/./os.h	5
src/utils/common.c	4
src/rsn_supp/./wpa_i.h	22
src/rsn_supp/../common/defs.h	8
src/rsn_supp/../common/wpa_common.h	3
src/common/wpa_common.c	37
src/common/./defs.h	8
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/os.h	1
src/crypto/../utils/common.h	4
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/rsn_supp/../utils/common.h	8
src/eapol_supp/eapol_supp_sm.c	50
src/rsn_supp/wpa_ie.c	6
src/rsn_supp/preauth.c	6
src/utils/wpabuf.c	9
src/eap_peer/eap.c	62
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/eap_peer/../utils/common.h	4
src/utils/./wpabuf.h	5
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	2
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/l2_packet/l2_packet_linux.c	3
src/l2_packet/../utils/common.h	2
src/eap_peer/../utils/list.h	1
src/rsn_supp/wpa_ft.c	6
src/common/ieee802_11_common.c	4
src/common/./ieee802_11_common.h	4
src/common/../utils/wpabuf.h	2
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/rsn_supp/tdls.c	21
src/rsn_supp/../rsn_supp/wpa_i.h	4
tests/fuzzing/eapol-key-supp/../../../src/utils/common.h	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/common/../utils/common.h	5
src/common/../utils/os.h	1
src/crypto/sha256-prf.c	2
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5

Fuzzer: tls-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1520	82.0%
gold	[1:9]	280	15.1%
yellow	[10:29]	24	1.29%
greenyellow	[30:49]	17	0.91%
lawngreen	50+	12	0.64%
All colors	1853	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
311	964	tlsv1_record_set_cipher_suite	call site: 00964	tls_process_certificate
238	1588	tlsv1_record_change_write_cipher	call site: 01588	tls_write_server_key_exchange
194	521	crypto_rsa_import_private_key	call site: 00521	pkcs8_enc_key_import
161	1426	tlsv1_record_change_read_cipher	call site: 01426	tlsv1_server_handshake_write
149	1276	crypto_public_key_free	call site: 01276	x509_certificate_chain_validate
84	877	LLVMFuzzerTestOneInput	call site: 00877	tls_connection_server_handshake
33	779	tls_verify_hash_free	call site: 00779	sha384_done
27	149	wpa_hexdump_ascii	call site: 00149	wpa_printf
26	334	x509_parse_ext_basic_constraints	call site: 00334	x509_parse_ext_certificate_policies
19	307	x509_parse_alt_name_dns	call site: 00307	x509_parse_ext_issuer_alt_name
17	859	read_msg	call site: 00859	wpabuf_put_data
16	825	crypto_hash_init	call site: 00825	sha256_done

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

285

Reachable functions

406

Percentage of reachable functions covered

29.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/tls-server/tls-server.c	2
tests/fuzzing/tls-server/../fuzzer-common.c	1
src/crypto/tls_internal.c	11
src/tls/tlsv1_client.c	10
src/crypto/crypto_internal.c	5
src/tls/tlsv1_server.c	14
src/utils/os_unix.c	8
src/tls/tlsv1_cred.c	15
src/tls/x509v3.c	59
src/utils/wpa_debug.c	8
src/crypto/crypto_internal-rsa.c	8
src/tls/rsa.c	6
src/tls/bignum.c	12
src/tls/./libtommath.c	42
src/utils/common.c	7
src/tls/asn1.c	10
src/tls/./asn1.h	12
src/tls/../utils/os.h	1
src/utils/base64.c	2
src/tls/pkcs8.c	2
src/tls/pkcs5.c	13
src/tls/../utils/common.h	6
src/crypto/sha1-pbkdf2.c	2
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/crypto/../utils/os.h	1
src/crypto/crypto_internal-cipher.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/aes-internal-dec.c	5
src/crypto/./aes_i.h	1
src/crypto/des-internal.c	9
src/crypto/md5-internal.c	5
src/crypto/rc4.c	1
src/crypto/../utils/common.h	4
src/tls/tlsv1_common.c	12
src/crypto/sha256-internal.c	5
src/crypto/sha384-internal.c	4
src/crypto/sha512-internal.c	5
tests/fuzzing/tls-server/../../../src/utils/common.h	1
src/utils/wpabuf.c	7
tests/fuzzing/tls-server/../../../src/utils/wpabuf.h	4
src/utils/./wpabuf.h	4
tests/fuzzing/tls-server/../../../src/utils/wpa_debug.h	1
src/crypto/../utils/wpabuf.h	4
src/tls/tlsv1_record.c	5
src/tls/tlsv1_server_read.c	12
src/crypto/crypto_internal-modexp.c	1
src/crypto/sha256-tlsprf.c	1
src/crypto/sha256.c	2
src/crypto/sha1-tlsprf.c	1
src/crypto/md5.c	2
src/tls/pkcs1.c	4
src/tls/tlsv1_server_write.c	13
src/tls/../utils/wpabuf.h	4

Fuzzer: dpp-uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3368	95.8%
gold	[1:9]	7	0.19%
yellow	[10:29]	15	0.42%
greenyellow	[30:49]	27	0.76%
lawngreen	50+	96	2.73%
All colors	3513	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3287	212	dpp_global_clear	call site: 00212	dpp_connection_remove
29	18	wpa_hexdump_ascii	call site: 00018	wpa_debug_print_timestamp
11	121	wpa_hexdump	call site: 00121	wpa_debug_print_timestamp
6	3500	dpp_global_clear	call site: 03500	dpp_relay_controller_free
5	49	dpp_parse_uri	call site: 00049	wpa_debug_print_timestamp
5	206	dpp_global_clear	call site: 00206	dpp_configurator_free
4	140	openssl_digest_vector	call site: 00140	wpa_printf
4	145	openssl_digest_vector	call site: 00145	wpa_printf
4	150	openssl_digest_vector	call site: 00150	wpa_printf
3	3508	dpp_controller_stop	call site: 03508	dpp_connection_remove
2	180	dpp_bootstrap_info_free	call site: 00180	forced_memzero
1	2	wpa_fuzzer_set_debug_level	call site: 00002	atoi

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

562

Reachable functions

625

Percentage of reachable functions covered

10.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/dpp-uri/dpp-uri.c	1
tests/fuzzing/dpp-uri/../fuzzer-common.c	1
src/utils/os_unix.c	11
tests/fuzzing/dpp-uri/../../../src/common/dpp.c	90
tests/fuzzing/dpp-uri/../../../src/utils/list.h	3
src/utils/wpa_debug.c	9
src/common/ieee802_11_common.c	8
src/utils/common.c	14
src/utils/ip_addr.c	2
src/utils/base64.c	7
tests/fuzzing/dpp-uri/../../../src/common/dpp_crypto.c	40
tests/fuzzing/dpp-uri/../../../src/crypto/crypto_openssl.c	67
tests/fuzzing/dpp-uri/../../../src/utils/os.h	2
src/utils/../utils/os.h	2
tests/fuzzing/dpp-uri/../../../src/common/dpp_tcp.c	37
src/utils/eloop.c	8
src/utils/./list.h	3
src/utils/./os.h	4
src/utils/wpabuf.c	8
src/utils/./wpabuf.h	5
tests/fuzzing/dpp-uri/../../../src/crypto/sha256-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/crypto/sha384-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/crypto/sha512-kdf.c	1
tests/fuzzing/dpp-uri/../../../src/utils/wpa_debug.h	2
tests/fuzzing/dpp-uri/../../../src/utils/wpabuf.h	13
src/utils/json.c	22
tests/fuzzing/dpp-uri/../../../src/utils/common.h	8
tests/fuzzing/dpp-uri/../../../src/crypto/aes-siv.c	7
tests/fuzzing/dpp-uri/../../../src/crypto/aes-ctr.c	1
src/common/gas.c	2
src/common/../utils/wpabuf.h	1
tests/fuzzing/dpp-uri/../../../src/common/dpp_auth.c	14
tests/fuzzing/dpp-uri/../../../src/common/dpp_backup.c	17
tests/fuzzing/dpp-uri/../../../src/common/dpp_reconfig.c	5
tests/fuzzing/dpp-uri/../../../src/common/dpp_pkex.c	11
tests/fuzzing/dpp-uri/../../../src/tls/asn1.c	22
tests/fuzzing/dpp-uri/../../../src/tls/asn1.h	7
/usr/include/openssl/x509.h	2

Fuzzer: eapol-supp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1407	72.1%
gold	[1:9]	38	1.94%
yellow	[10:29]	24	1.23%
greenyellow	[30:49]	20	1.02%
lawngreen	50+	460	23.6%
All colors	1949	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
220	1589	wpa_sm_rx_eapol	call site: 01589	wpa_supplicant_process_3_of_4
184	1264	wpa_supplicant_send_2_of_4	call site: 01264	wpa_supplicant_process_1_of_2_wpa
73	701	omac1_aes_vector	call site: 00701	wpa_sm_tptk_to_ptk
73	1126	wpa_derive_ptk	call site: 01126	wpa_derive_ptk_ft
63	1481	eapol_sm_deinit	call site: 01481	wpa_ft_prepare_auth_request
60	865	wpa_sm_rsn_overriding_supported	call site: 00865	wpa_supplicant_send_4_of_4
54	1844	wpa_supplicant_process_1_of_4	call site: 01844	wpa_supplicant_process_mlo_1_of_2
45	1009	wpa_supplicant_get_pmk	call site: 01009	pmksa_cache_add
44	1064	pmksa_cache_set_expiration	call site: 01064	pmksa_cache_add
28	424	eap_sm_buildNak	call site: 00424	eap_sm_build_expanded_nak
28	836	wpa_parse_kde_ies	call site: 00836	wpa_supplicant_validate_ie
26	937	wpa_eapol_key_send	call site: 00937	wpa_supplicant_install_ptk

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

270

Reachable functions

483

Percentage of reachable functions covered

44.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-supp/eapol-supp.c	4
tests/fuzzing/eapol-supp/../fuzzer-common.c	1
src/utils/os_unix.c	9
src/utils/eloop.c	18
src/utils/./list.h	5
src/utils/wpa_debug.c	8
src/rsn_supp/wpa.c	79
src/rsn_supp/../utils/list.h	3
src/rsn_supp/pmksa_cache.c	14
src/utils/./os.h	5
src/utils/common.c	4
src/rsn_supp/./wpa_i.h	22
src/eapol_supp/eapol_supp_sm.c	50
src/eap_peer/eap.c	62
src/eap_peer/../utils/list.h	1
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/utils/wpabuf.c	9
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/crypto/sha1-internal.c	5
src/crypto/../utils/os.h	1
src/eap_peer/../utils/common.h	4
src/utils/./wpabuf.h	5
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	2
src/rsn_supp/wpa_ie.c	6
src/rsn_supp/../utils/common.h	7
src/common/wpa_common.c	37
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/sha1.c	2
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/common/../utils/common.h	5
src/rsn_supp/../common/wpa_common.h	3
src/common/../utils/os.h	1
src/rsn_supp/../common/defs.h	8
src/common/./defs.h	8
src/rsn_supp/wpa_ft.c	5
src/crypto/sha256-prf.c	2
src/common/ieee802_11_common.c	4
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/rsn_supp/preauth.c	6
src/l2_packet/l2_packet_linux.c	3
src/l2_packet/../utils/common.h	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/common/./ieee802_11_common.h	4
src/common/../utils/wpabuf.h	2

Fuzzer: scan-res

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	268	61.3%
gold	[1:9]	2	0.45%
yellow	[10:29]	2	0.45%
greenyellow	[30:49]	3	0.68%
lawngreen	50+	162	37.0%
All colors	437	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	181	wpa_bss_in_use	call site: 00181	wpa_bss_is_wps_candidate
73	349	wpas_notify_bss_added	call site: 00349	wpa_bss_update
25	311	wpa_bss_remove	call site: 00311	wpa_bss_remove
15	13	wpa_hexdump	call site: 00013	wpa_debug_print_timestamp
8	36	wpa_msg	call site: 00036	wpa_printf
7	173	wpa_bss_parse_basic_ml_element	call site: 00173	wpa_bss_remove_oldest
4	49	process_scan_res	call site: 00049	wpa_msg
4	73	wpa_bss_get	call site: 00073	ether_addr_equal
4	306	wpas_notify_bss_removed	call site: 00306	wpa_printf
3	133	wpabuf_put	call site: 00133	wpabuf_overflow
2	138	ieee802_11_defrag	call site: 00138	wpabuf_alloc
2	295	wpa_bss_check_pending_connect	call site: 00295	wpa_bss_update_pending_connect

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

65

Reachable functions

149

Percentage of reachable functions covered

56.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/scan-res/scan-res.c	4
tests/fuzzing/scan-res/../fuzzer-common.c	1
src/utils/os_unix.c	6
tests/fuzzing/scan-res/../../../wpa_supplicant/bss.c	30
tests/fuzzing/scan-res/../../../src/utils/list.h	5
src/utils/wpa_debug.c	6
src/utils/./os.h	2
src/utils/common.c	4
tests/fuzzing/scan-res/../../../src/utils/os.h	4
tests/fuzzing/scan-res/../../../wpa_supplicant/scan.c	4
src/common/ieee802_11_common.c	16
src/common/./ieee802_11_common.h	5
tests/fuzzing/scan-res/../../../src/common/ieee802_11_common.h	4
tests/fuzzing/scan-res/../../../src/utils/common.h	4
tests/fuzzing/scan-res/../../../wpa_supplicant/bss.h	1
src/common/../utils/common.h	1
src/utils/wpabuf.c	6
src/utils/./wpabuf.h	4
src/common/../utils/wpabuf.h	1
tests/fuzzing/scan-res/../../../src/utils/wpabuf.h	4
src/wps/wps.c	3
src/wps/wps_attr_parse.c	5
src/wps/../utils/wpabuf.h	2
src/wps/../utils/common.h	3
src/wps/../utils/wpa_debug.h	1
src/eap_peer/eap.c	2
tests/fuzzing/scan-res/../../../wpa_supplicant/wpa_supplicant.c	1
tests/fuzzing/scan-res/../../../wpa_supplicant/notify.c	12
tests/fuzzing/scan-res/../../../wpa_supplicant/dbus/dbus_new.h	3

Fuzzer: eapol-key-auth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1257	73.1%
gold	[1:9]	1	0.05%
yellow	[10:29]	3	0.17%
greenyellow	[30:49]	1	0.05%
lawngreen	50+	456	26.5%
All colors	1718	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
246	1433	wpa_auth_sta_deinit	call site: 01433	wpa_ft_expire_pull
94	572	wpa_derive_ptk	call site: 00572	wpa_auth_derive_ptk_ft
76	1082	sm_WPA_PTK_PTKINITDONE_Enter	call site: 01082	wpa_ft_generate_pmk_r1
55	1294	wpa_validate_wpa_ie	call site: 01294	pmksa_cache_add_okc
51	735	wpa_parse_kde_ies	call site: 00735	wpa_parse_generic
44	885	sm_WPA_PTK_PTKCALCNEGOTIATING_Enter	call site: 00885	wpa_auth_ft_store_keys
42	351	hmac_sha1	call site: 00351	rsn_eapol_key_mic_hash
35	1253	wpa_validate_wpa_ie	call site: 01253	wpa_parse_wpa_ie_wpa
33	244	ieee80211w_kde_add	call site: 00244	wpa_send_eapol
32	836	sm_WPA_PTK_PTKCALCNEGOTIATING_Enter	call site: 00836	wpa_parse_wpa_ie_rsn
30	62	wpa_auth_gen_wpa_ie	call site: 00062	wpa_write_rsne_override
23	1185	wpa_ft_pmk_cache_init	call site: 01185	wpa_rekey_gtk

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

227

Reachable functions

423

Percentage of reachable functions covered

46.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/eapol-key-auth/eapol-key-auth.c	4
tests/fuzzing/eapol-key-auth/../fuzzer-common.c	1
src/utils/os_unix.c	8
src/utils/eloop.c	12
src/utils/./list.h	5
src/utils/wpa_debug.c	8
src/ap/wpa_auth.c	110
src/ap/wpa_auth_ie.c	14
src/ap/../utils/common.h	7
src/common/wpa_common.c	46
src/common/../utils/common.h	5
src/ap/../common/defs.h	11
src/ap/wpa_auth_ft.c	62
src/utils/common.c	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/crypto/sha1-prf.c	1
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/crypto/../utils/os.h	1
src/ap/./wpa_auth.h	1
src/common/./defs.h	8
src/crypto/aes-wrap.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/rc4.c	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/aes-omac1.c	4
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/utils/./os.h	4
src/utils/wpabuf.c	7
src/common/ieee802_11_common.c	12
src/crypto/sha256-prf.c	2
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/common/../utils/os.h	1
src/ap/../utils/list.h	4
src/common/./ieee802_11_common.h	5
src/crypto/aes-siv.c	6
src/crypto/aes-ctr.c	1
src/ap/pmksa_cache_auth.c	11
src/radius/radius.c	2
src/ap/../common/wpa_common.h	2
src/utils/./wpabuf.h	5
src/radius/../utils/os.h	1
src/ap/../utils/wpabuf.h	2
src/common/../utils/wpabuf.h	3

Fuzzer: wnm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6760	96.9%
gold	[1:9]	12	0.17%
yellow	[10:29]	21	0.30%
greenyellow	[30:49]	3	0.04%
lawngreen	50+	175	2.51%
All colors	6971	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1981	3772	wpabuf_head_u8	call site: 03772	interworking_anqp_resp_cb
1177	2594	dl_list_add_tail	call site: 02594	wpa_supplicant_mark_disassoc
1072	5839	ieee802_11_rx_wnm_action	call site: 05839	wpas_rrm_handle_radio_measurement_request
645	1204	wpa_supplicant_req_scan	call site: 01204	wpa_supplicant_scan
602	1850	dl_list_add_tail	call site: 01850	wpa_supplicant_deauthenticate
256	163	get_ie	call site: 00163	wpa_scan_res_ok
247	943	eloop_remove_timeout	call site: 00943	wpa_supplicant_req_scan
178	550	wpa_supplicant_get_scan_results	call site: 00550	wpa_bss_update_scan_res
140	2453	wpabuf_mhead_u8	call site: 02453	wpas_clear_beacon_rep_data
110	832	wpa_supplicant_select_bss	call site: 00832	wnm_bss_tm_connect
92	729	dl_list_add_tail	call site: 00729	wpa_bss_update
50	420	wpabuf_mhead_u8	call site: 00420	wnm_nei_rep_add_bss

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

1401

Reachable functions

1492

Percentage of reachable functions covered

6.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/wnm/wnm.c	4
tests/fuzzing/wnm/../fuzzer-common.c	1
src/utils/os_unix.c	12
src/utils/eloop.c	21
src/utils/./list.h	5
src/utils/wpa_debug.c	9
tests/fuzzing/wnm/../../../wpa_supplicant/bss.c	46
tests/fuzzing/wnm/../../../src/utils/list.h	6
src/utils/./os.h	5
tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c	37
tests/fuzzing/wnm/../../../src/utils/common.h	16
src/rsn_supp/wpa.c	105
src/common/wpa_common.c	44
src/common/../utils/common.h	6
src/utils/common.c	23
src/utils/wpabuf.c	10
tests/fuzzing/wnm/../../../wpa_supplicant/notify.c	41
tests/fuzzing/wnm/../../../wpa_supplicant/dbus/dbus_new.h	13
tests/fuzzing/wnm/../../../src/utils/wpabuf.h	14
src/utils/./wpabuf.h	5
tests/fuzzing/wnm/../../../src/utils/os.h	9
tests/fuzzing/wnm/../../../wpa_supplicant/events.c	101
tests/fuzzing/wnm/../../../wpa_supplicant/bss.h	4
tests/fuzzing/wnm/../../../src/common/ieee802_11_common.h	4
tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant.c	115
src/common/ieee802_11_common.c	59
src/common/./ieee802_11_common.h	5
tests/fuzzing/wnm/../../../wpa_supplicant/bssid_ignore.c	6
tests/fuzzing/wnm/../../../wpa_supplicant/scan.c	62
tests/fuzzing/wnm/../../../src/common/defs.h	10
tests/fuzzing/wnm/../../../wpa_supplicant/wps_supplicant.h	10
src/rsn_supp/wpa_ie.c	12
src/rsn_supp/../utils/common.h	9
tests/fuzzing/wnm/../../../src/drivers/driver_common.c	8
src/common/../utils/wpabuf.h	8
tests/fuzzing/wnm/../../../src/utils/wpa_debug.h	1
src/eap_peer/eap.c	64
tests/fuzzing/wnm/../../../wpa_supplicant/nan_supplicant.h	10
tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant_i.h	4
tests/fuzzing/wnm/../../../wpa_supplicant/driver_i.h	32
tests/fuzzing/wnm/../../../wpa_supplicant/p2p_supplicant.h	15
tests/fuzzing/wnm/../../../wpa_supplicant/sme.h	14
tests/fuzzing/wnm/../../../wpa_supplicant/robust_av.c	33
tests/fuzzing/wnm/../../../wpa_supplicant/autoscan.h	3
tests/fuzzing/wnm/../../../wpa_supplicant/wmm_ac.c	24
src/eapol_supp/eapol_supp_sm.c	55
src/eapol_supp/../utils/wpabuf.h	2
src/eap_peer/../utils/wpabuf.h	7
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
src/crypto/sha1-internal.c	5
src/crypto/../utils/os.h	1
src/eap_peer/../utils/common.h	4
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	6
src/eap_common/../utils/common.h	4
src/eap_peer/eap_methods.c	3
tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.h	1
tests/fuzzing/wnm/../../../wpa_supplicant/wpas_glue.c	5
src/rsn_supp/preauth.c	10
src/rsn_supp/../utils/list.h	4
src/rsn_supp/pmksa_cache.c	18
src/rsn_supp/../common/defs.h	9
src/rsn_supp/../common/wpa_common.h	3
src/common/./defs.h	8
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/crypto/sha1.c	2
src/rsn_supp/./wpa_i.h	21
src/l2_packet/l2_packet_linux.c	9
src/l2_packet/../utils/common.h	2
src/eap_peer/../utils/list.h	1
src/crypto/tls_internal.c	2
src/tls/tlsv1_client.c	2
src/crypto/crypto_internal.c	2
src/tls/tlsv1_server.c	2
src/tls/tlsv1_cred.c	1
src/tls/x509v3.c	3
src/crypto/crypto_internal-rsa.c	1
src/tls/rsa.c	1
src/tls/bignum.c	1
src/tls/./libtommath.c	1
src/crypto/md5.c	2
src/crypto/md5-internal.c	5
src/crypto/aes-omac1.c	4
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/rsn_supp/tdls.c	22
src/rsn_supp/../rsn_supp/wpa_i.h	4
src/l2_packet/../utils/os.h	1
tests/fuzzing/wnm/../../../wpa_supplicant/rrm.c	30
tests/fuzzing/wnm/../../../wpa_supplicant/hs20_supplicant.c	8
tests/fuzzing/wnm/../../../wpa_supplicant/pr_supplicant.h	2
src/utils/bitfield.c	4
src/common/ptksa_cache.c	4
src/common/../utils/list.h	5
src/crypto/sha1-pbkdf2.c	2
tests/fuzzing/wnm/../../../wpa_supplicant/op_classes.c	11
tests/fuzzing/wnm/../../../wpa_supplicant/config.c	13
src/utils/../utils/os.h	2
src/common/hw_features_common.c	10
tests/fuzzing/wnm/../../../src/rsn_supp/wpa.h	2
tests/fuzzing/wnm/../../../wpa_supplicant/bgscan.h	3
src/utils/crc32.c	1
tests/fuzzing/wnm/../../../wpa_supplicant/interworking.c	60
src/common/gas.c	8
tests/fuzzing/wnm/../../../wpa_supplicant/gas_query.c	22
tests/fuzzing/wnm/../../../wpa_supplicant/offchannel.c	5
src/common/../utils/os.h	1
src/rsn_supp/wpa_ft.c	6
src/crypto/sha256-prf.c	2
src/crypto/sha1-prf.c	1
src/crypto/rc4.c	1
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
tests/fuzzing/wnm/../../../wpa_supplicant/mesh_mpm.h	2
tests/fuzzing/wnm/../../../wpa_supplicant/config_file.c	20
src/utils/base64.c	2

Fuzzer: ap-mgmt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4847	95.3%
gold	[1:9]	1	0.01%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	237	4.66%
All colors	5085	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1175	3377	dl_list_add_tail	call site: 03377	handle_assoc
957	802	wpa_hexdump	call site: 00802	ap_handle_timer
739	2067	ap_free_sta	call site: 02067	ap_ht2040_timeout
446	4553	dl_list_add_tail	call site: 04553	handle_action
255	288	eloop_remove_timeout	call site: 00288	accounting_interim_update
244	2997	__ieee802_11_parse_elems	call site: 02997	ap_sta_handle_disconnect
213	73	ap_free_sta	call site: 00073	accounting_sta_report
203	598	hostapd_set_sta_flags	call site: 00598	ap_handle_timer
201	1846	element_next	call site: 01846	ap_free_sta
85	2885	set_wpa_sm_for_each_partner_link	call site: 02885	wpa_auth_sta_deinit
84	1760	ether_addr_equal	call site: 01760	wpa_send_eapol_timeout
48	545	ap_sta_set_authorized	call site: 00545	hostapd_prune_associations

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

1065

Reachable functions

1186

Percentage of reachable functions covered

10.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/ap-mgmt/ap-mgmt.c	4
tests/fuzzing/ap-mgmt/../fuzzer-common.c	1
src/utils/os_unix.c	11
src/utils/eloop.c	21
src/utils/./list.h	5
src/utils/wpa_debug.c	11
src/ap/ap_config.c	19
src/ap/../utils/os.h	7
src/ap/../utils/list.h	6
src/ap/./ap_config.h	4
src/common/ieee802_11_common.c	40
src/ap/sta_info.c	52
src/ap/accounting.c	7
src/radius/radius.c	28
src/utils/./os.h	5
src/utils/common.c	13
src/radius/radius_client.c	20
src/utils/wpabuf.c	8
src/radius/../utils/os.h	3
src/utils/./wpabuf.h	5
src/ap/../radius/radius.h	1
src/radius/../utils/wpabuf.h	8
src/ap/ieee802_1x.c	12
src/ap/../utils/common.h	16
src/ap/../common/defs.h	11
src/ap/wpa_auth.c	120
src/common/wpa_common.c	48
src/ap/../utils/wpabuf.h	13
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/ap/./ap_drv_ops.h	7
src/utils/ip_addr.c	1
src/crypto/md5-internal.c	5
src/crypto/../utils/os.h	1
src/utils/../utils/os.h	2
src/radius/../utils/common.h	3
src/crypto/md5.c	2
src/ap/./sta_info.h	4
src/ap/utils.c	2
src/ap/ieee802_11.c	75
src/ap/ieee802_11_shared.c	32
src/ap/hostapd.c	15
src/ap/ap_drv_ops.c	22
src/eapol_auth/eapol_auth_sm.c	36
src/eap_server/eap_server_methods.c	2
src/eapol_auth/../utils/wpabuf.h	2
src/eap_common/eap_common.c	4
src/eap_common/../utils/wpabuf.h	5
src/eap_server/eap_server.c	54
src/eap_server/../utils/wpabuf.h	4
src/eap_server/../utils/common.h	2
src/eap_common/../utils/common.h	2
src/ap/ap_mlme.c	5
src/crypto/sha1-prf.c	1
src/crypto/sha1.c	2
src/crypto/sha1-internal.c	5
src/ap/./wpa_auth.h	1
src/common/./defs.h	8
src/crypto/sha256.c	2
src/crypto/sha256-internal.c	5
src/crypto/../utils/common.h	4
src/ap/wpa_auth_ie.c	11
src/crypto/aes-wrap.c	1
src/crypto/aes-internal-enc.c	4
src/crypto/aes-internal.c	1
src/crypto/./aes_i.h	1
src/crypto/rc4.c	1
src/crypto/aes-omac1.c	4
src/crypto/sha256-prf.c	2
src/ap/wpa_auth_ft.c	67
src/crypto/aes-unwrap.c	1
src/crypto/aes-internal-dec.c	5
src/common/../utils/common.h	7
src/common/../utils/os.h	1
src/common/./ieee802_11_common.h	5
src/crypto/aes-siv.c	6
src/crypto/aes-ctr.c	1
src/ap/ndisc_snoop.c	1
src/ap/ieee802_11_ht.c	14
src/ap/beacon.c	54
src/ap/./hostapd.h	7
src/ap/../common/ieee802_11_defs.h	3
src/ap/ieee802_11_eht.c	36
src/common/hw_features_common.c	8
src/ap/./ieee802_11.h	3
src/ap/dfs.c	4
src/ap/ieee802_11_he.c	14
src/ap/ieee802_11_vht.c	9
src/ap/ieee802_11_uhr.c	6
src/ap/wmm.c	10
src/ap/hs20.c	1
src/crypto/sha1-pbkdf2.c	2
src/wps/wps.c	2
src/wps/../utils/wpabuf.h	8
src/wps/../utils/common.h	5
src/wps/wps_attr_build.c	3
src/ap/../common/ieee802_11_common.h	5
src/common/../utils/wpabuf.h	5
src/ap/wps_hostapd.c	2
src/ap/./preauth_auth.h	1
src/ap/vlan_init.c	4
src/ap/ieee802_11_auth.c	7
src/ap/./mbo_ap.h	1
src/ap/robust_av.c	27
tests/fuzzing/ap-mgmt/../../../src/utils/common.h	1
src/ap/ap_list.c	11
src/ap/hw_features.c	2
src/ap/vlan.c	1
src/ap/vlan_ifconfig.c	3
src/wps/wps_attr_parse.c	5
src/wps/../utils/wpa_debug.h	1
src/ap/../wps/wps.h	1
src/ap/pmksa_cache_auth.c	8
src/ap/../common/wpa_common.h	2
src/common/ptksa_cache.c	4
src/common/../utils/list.h	5
src/ap/rrm.c	14

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
hostapd_reload_config	/src/hostap/src/ap/hostapd.c	1	['N/A']	74	0	383	40	16	1643	0	12135	3021
wpa_supplicant_add_iface	/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wpa_supplicant.c	3	['N/A', 'N/A', 'N/A']	102	0	204	30	12	1754	0	13116	1207
hostapd_mgmt_tx_cb	/src/hostap/src/ap/drv_callbacks.c	6	['N/A', 'N/A', 'size_t', 'short', 'int', 'int']	62	0	164	30	12	915	0	6475	506

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

4054 / 5869

Cyclomatic complexity statically reachable by fuzzers

32096 / 43232

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzzing/asn1/asn1.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump_ascii', 'asn1_parse', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/json/json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['json_alloc_token', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/eap-sim-peer/eap-sim-peer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/eap-aka-peer/eap-aka-peer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/eap-mschapv2-peer/eap-mschapv2-peer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/ml-elems/ml-elems.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ieee802_11_parse_ext_len_elem', 'wpa_hexdump', 'wpabuf_put', 'ieee802_11_defrag', 'wpa_fuzzer_set_debug_level', 'wpabuf_resize']

tests/fuzzing/sae/sae.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sae_parse_commit', 'wpa_hexdump_ascii', 'wpa_hexdump', 'sae_group_allowed', 'crypto_bignum_init_set', 'sae_set_group', 'crypto_ec_point_from_bin', 'sae_parse_password_identifier', 'wpabuf_put']

tests/fuzzing/x509/x509.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump_ascii', 'wpa_hexdump', 'asn1_get_next', 'x509_certificate_parse', 'wpa_fuzzer_set_debug_level', 'x509_certificate_free', 'x509_parse_name', 'x509_parse_time']

tests/fuzzing/pasn-resp/pasn-resp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['bin_clear_free', 'handle_auth_pasn_resp', 'handle_auth_pasn_3', 'handle_auth_pasn_1', 'wpabuf_put_u8', 'eloop_init', 'os_get_reltime', 'wpa_hexdump', 'openssl_hmac_vector']

tests/fuzzing/radius/radius.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_put', 'wpa_hexdump', 'radius_msg_add_attr', 'hmac_md5_vector', 'radius_msg_finish', 'wpa_fuzzer_set_debug_level', 'os_calloc']

tests/fuzzing/pasn-init/pasn-init.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['eloop_init', 'wpa_fuzzer_set_debug_level']

tests/fuzzing/tls-client/tls-client.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['x509_certificate_chain_free', 'pkcs1_decrypt_public_key', 'x509_certificate_parse', 'tls_process_certificate', 'wpa_hexdump_ascii', 'tlsv1_client_decrypt', 'tls_process_server_key_exchange', 'tls_write_client_key_exchange', 's_mp_exptmod', 'x509_parse_algorithm_identifier']

tests/fuzzing/p2p/p2p.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['p2p_build_probe_resp_ies', 'p2p_peer_channels_check', 'p2p_reply_probe', 'p2p_process_go_neg_resp', 'p2p_clear_timeout', 'wpabuf_mhead_u8', 'p2p_rx_gas_initial_resp', 'p2p_handle_go_neg_conf', 'p2p_rx_gas_comeback_resp', 'p2p_process_presence_req']

tests/fuzzing/eapol-key-supp/eapol-key-supp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_hexdump_ascii', 'wpa_sm_notify_assoc', 'wpa_supplicant_process_3_of_4', 'wpa_derive_ptk', 'omac1_aes_128', 'wpa_hexdump_key', 'wpa_cipher_valid_group', 'aes_unwrap', 'wpa_supplicant_get_pmk']

tests/fuzzing/tls-server/tls-server.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['tlsv1_record_set_cipher_suite', 'tlsv1_record_change_write_cipher', 'crypto_rsa_import_private_key', 'tlsv1_record_change_read_cipher', 'crypto_public_key_free', 'LLVMFuzzerTestOneInput', 'tls_verify_hash_free', 'wpa_hexdump_ascii', 'x509_parse_ext_basic_constraints', 'x509_parse_alt_name_dns']

tests/fuzzing/dpp-uri/dpp-uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['dpp_global_clear', 'wpa_hexdump_ascii', 'wpa_hexdump', 'dpp_parse_uri', 'openssl_digest_vector', 'dpp_controller_stop']

tests/fuzzing/eapol-supp/eapol-supp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_sm_rx_eapol', 'wpa_supplicant_send_2_of_4', 'omac1_aes_vector', 'wpa_derive_ptk', 'eapol_sm_deinit', 'wpa_sm_rsn_overriding_supported', 'wpa_supplicant_process_1_of_4', 'wpa_supplicant_get_pmk', 'pmksa_cache_set_expiration', 'eap_sm_buildNak']

tests/fuzzing/scan-res/scan-res.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_bss_in_use', 'wpas_notify_bss_added', 'wpa_bss_remove', 'wpa_hexdump', 'wpa_msg', 'wpa_bss_parse_basic_ml_element', 'process_scan_res', 'wpa_bss_get', 'wpas_notify_bss_removed', 'wpabuf_put']

tests/fuzzing/eapol-key-auth/eapol-key-auth.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpa_auth_sta_deinit', 'wpa_derive_ptk', 'sm_WPA_PTK_PTKINITDONE_Enter', 'wpa_validate_wpa_ie', 'wpa_parse_kde_ies', 'sm_WPA_PTK_PTKCALCNEGOTIATING_Enter', 'hmac_sha1', 'ieee80211w_kde_add']

tests/fuzzing/wnm/wnm.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['wpabuf_head_u8', 'dl_list_add_tail', 'ieee802_11_rx_wnm_action', 'wpa_supplicant_req_scan', 'get_ie', 'eloop_remove_timeout', 'wpa_supplicant_get_scan_results', 'wpabuf_mhead_u8', 'wpa_supplicant_select_bss']

tests/fuzzing/ap-mgmt/ap-mgmt.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['dl_list_add_tail', 'wpa_hexdump', 'ap_free_sta', 'eloop_remove_timeout', '__ieee802_11_parse_elems', 'hostapd_set_sta_flags', 'element_next', 'set_wpa_sm_for_each_partner_link']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
eap_sim_report_notification	39	21	53.84%	['eap-aka-peer', 'eap-sim-peer']
eap_sim_init	56	16	28.57%	['eap-sim-peer']
eap_aka_init	34	17	50.0%	['eap-aka-peer']
eap_aka_process_reauthentication	96	26	27.08%	['eap-aka-peer']
utf8_to_ucs2	35	14	40.0%	['eap-mschapv2-peer']
eap_mschapv2_success	41	15	36.58%	['eap-mschapv2-peer']
sae_set_group	53	18	33.96%	['pasn-resp', 'pasn-init', 'sae']
crypto_ec_group_2_nid	32	6	18.75%	['dpp-uri', 'pasn-resp', 'pasn-init', 'sae']
crypto_ecdh_init	48	25	52.08%	['pasn-init', 'pasn-resp']
handle_auth_pasn_resp	136	37	27.20%	['pasn-resp']
handle_auth_pasn_1	303	156	51.48%	['pasn-resp']
handle_auth_pasn_3	115	59	51.30%	['pasn-resp']
os_get_reltime	34	15	44.11%	['pasn-init', 'eapol-supp', 'scan-res', 'ap-mgmt', 'p2p', 'wnm', 'dpp-uri', 'eapol-key-auth', 'eapol-key-supp', 'pasn-resp']
radius_msg_add_attr	86	27	31.39%	['ap-mgmt', 'radius']
crypto_cipher_init	51	26	50.98%	['tls-client', 'tls-server']
tls_connection_encrypt	41	15	36.58%	['tls-client', 'tls-server']
tls_connection_decrypt2	31	8	25.80%	['tls-client', 'tls-server']
tlsv1_client_decrypt	88	46	52.27%	['tls-client', 'tls-server']
tls_process_server_change_cipher_spec	55	27	49.09%	['tls-client']
tls_process_server_finished	113	51	45.13%	['tls-client']
tls_write_client_certificate	58	31	53.44%	['tls-client']
tlsv1_key_x_dh	108	54	50.0%	['tls-client']
p2p_probe_req_rx	31	11	35.48%	['p2p']
p2p_state_txt	32	6	18.75%	['p2p']
p2p_reply_probe	117	20	17.09%	['p2p']
p2p_process_presence_req	54	16	29.62%	['p2p']
p2p_process_dev_disc_resp	47	12	25.53%	['p2p']
p2p_check_pref_chan	89	9	10.11%	['p2p']
p2p_process_go_neg_req	253	88	34.78%	['p2p']
p2p_process_go_neg_resp	220	16	7.272%	['p2p']
p2p_handle_go_neg_conf	76	12	15.78%	['p2p']
p2p_build_go_neg_resp	109	57	52.29%	['p2p']
p2p_process_invitation_resp	130	21	16.15%	['p2p']
p2p_build_invitation_resp	73	32	43.83%	['p2p']
p2p_process_prov_disc_req	495	194	39.19%	['p2p']
p2p_build_prov_disc_resp	122	27	22.13%	['p2p']
p2p_process_prov_disc_bootstrap_resp	97	17	17.52%	['p2p']
p2p_process_prov_disc_resp	213	40	18.77%	['p2p']
p2p_rx_gas_initial_req	75	10	13.33%	['p2p']
p2p_rx_gas_initial_resp	122	15	12.29%	['p2p']
p2p_rx_gas_comeback_req	59	20	33.89%	['p2p']
p2p_rx_gas_comeback_resp	145	17	11.72%	['p2p']
wps_build_wfa_ext	40	18	45.0%	['ap-mgmt', 'p2p']
wpa_eapol_key_mic	61	15	24.59%	['eapol-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth', 'eapol-key-supp']
pmksa_cache_set_expiration	42	8	19.04%	['pasn-init', 'eapol-supp', 'ap-mgmt', 'wnm', 'eapol-key-auth', 'eapol-key-supp']
wpa_supplicant_send_2_of_4	108	43	39.81%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_sm_set_param	103	25	24.27%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_supplicant_validate_ie	161	50	31.05%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_supplicant_get_pmk	166	18	10.84%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_supplicant_process_3_of_4	206	85	41.26%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_handle_ext_key_id	35	17	48.57%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_supplicant_process_1_of_2	74	18	24.32%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_gen_wpa_ie_rsn	87	39	44.82%	['eapol-key-supp', 'eapol-supp', 'wnm']
tls_global_set_params	42	22	52.38%	['tls-server']
tlsv1_set_ca_cert	45	9	20.0%	['tls-server']
tlsv1_set_dhparams_blob	33	17	51.51%	['tls-server']
crypto_ec_key_group	38	20	52.63%	['dpp-uri']
openssl_digest_vector	33	15	45.45%	['dpp-uri', 'pasn-init', 'pasn-resp']
eap_sm_buildIdentity	70	11	15.71%	['eapol-key-supp', 'eapol-supp', 'wnm']
sm_EAP_GET_METHOD_Enter	84	24	28.57%	['eapol-key-supp', 'eapol-supp', 'wnm']
eap_sm_buildNak	40	12	30.0%	['eapol-key-supp', 'eapol-supp', 'wnm']
sm_EAP_METHOD_Enter	51	9	17.64%	['eapol-key-supp', 'eapol-supp', 'wnm']
sm_SUPP_PAE_Step	84	34	40.47%	['eapol-key-supp', 'eapol-supp', 'wnm']
wpa_bss_anqp_free	36	6	16.66%	['scan-res', 'wnm']
wpa_bss_included_in_scan	33	5	15.15%	['scan-res', 'wnm']
wpa_init	83	32	38.55%	['eapol-key-auth']
wpa_auth_sta_associated	31	17	54.83%	['eapol-key-auth']
wpa_auth_sta_deinit	33	16	48.48%	['eapol-key-auth', 'ap-mgmt']
wpa_auth_sm_event	103	22	21.35%	['eapol-key-auth', 'ap-mgmt']
sm_WPA_PTK_PTKSTART_Enter	81	38	46.91%	['eapol-key-auth', 'ap-mgmt']
sm_WPA_PTK_PTKCALCNEGOTIATING_Enter	252	123	48.80%	['eapol-key-auth', 'ap-mgmt']
wpa_auth_validate_ml_kdes_m2	47	6	12.76%	['eapol-key-auth', 'ap-mgmt']
sm_WPA_PTK_PTKINITNEGOTIATING_Enter	231	94	40.69%	['eapol-key-auth', 'ap-mgmt']
wpa_auth_ml_kdes_len	44	7	15.90%	['eapol-key-auth', 'ap-mgmt']
ieee80211w_kde_add	56	27	48.21%	['eapol-key-auth', 'ap-mgmt']
wpa_auth_ml_kdes	98	6	6.122%	['eapol-key-auth', 'ap-mgmt']
wpa_auth_validate_ml_kdes_m4	37	10	27.02%	['eapol-key-auth', 'ap-mgmt']
wpa_gtk_update	48	26	54.16%	['eapol-key-auth', 'ap-mgmt']
wpa_group_config_group_keys	39	20	51.28%	['eapol-key-auth', 'ap-mgmt']
wpa_ft_deinit_rkh_tmp	40	12	30.0%	['eapol-key-auth']
wpa_auth_gen_wpa_ie	69	35	50.72%	['eapol-key-auth']
wpa_validate_wpa_ie	338	119	35.20%	['eapol-key-auth', 'ap-mgmt']
rsne_write_data	114	42	36.84%	['eapol-key-auth', 'ap-mgmt']
wpa_supplicant_select_bss	41	15	36.58%	['wnm']
hs20_rx_deauth_imminent_notice	34	5	14.70%	['wnm']
wpa_supplicant_get_scan_results	36	9	25.0%	['wnm']
wnm_scan_process	83	20	24.09%	['wnm']
wnm_set_scan_freqs	75	7	9.333%	['wnm']
ieee802_11_rx_wnmsleep_resp	85	13	15.29%	['wnm']
ieee802_11_mgmt	101	40	39.60%	['ap-mgmt']
hostapd_ht_operation_update	45	6	13.33%	['ap-mgmt']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/hostap/src/tls/tlsv1_server_write.c	['tls-server']	[]
/src/hostap/src/ap/./preauth_auth.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../../../src/eap_peer/eap_methods.h	[]	[]
/src/hostap/src/p2p/p2p_build.c	['p2p']	['p2p']
/src/hostap/src/crypto/sha256-prf.c	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/wpabuf.c	[]	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'tls-server', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/tls/tlsv1_common.c	['tls-client', 'tls-server']	['tls-client', 'tls-server']
/src/hostap/src/wps/../utils/wpabuf.h	['p2p', 'scan-res', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/radius/../../../src/radius/radius.c	['radius']	['ap-mgmt']
/src/hostap/tests/fuzzing/radius/../../../src/utils/os.h	['radius']	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/sha1-prf.c	[]	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/tests/fuzzing/json/../../../src/utils/common.c	['json']	['sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/p2p/p2p_parse.c	['p2p']	['p2p']
/src/hostap/src/tls/../utils/common.h	['tls-client', 'tls-server']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/mesh.h	[]	[]
/src/hostap/src/crypto/milenage.c	[]	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/eap-mschapv2-peer.c	['eap-mschapv2-peer']	['eap-mschapv2-peer']
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha384-kdf.c	[]	[]
/src/hostap/src/ap/ieee802_11_he.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/sae.c	['pasn-resp']	['sae']
/src/hostap/tests/fuzzing/sae/../fuzzer-common.c	['sae']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/config.c	[]	[]
/src/hostap/src/common/../utils/wpa_debug.h	['sae']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/op_classes.c	['wnm']	[]
/src/hostap/src/crypto/aes-internal.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client', 'eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/src/wps/wps.c	['scan-res', 'ap-mgmt']	[]
/src/hostap/src/tls/tlsv1_record.c	['tls-client', 'tls-server']	['tls-client', 'tls-server']
/src/hostap/src/tls/x509v3.c	['x509', 'tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['x509', 'tls-client', 'tls-server']
/src/hostap/tests/fuzzing/ml-elems/../../../src/common/ieee802_11_common.c	['ml-elems']	['p2p', 'dpp-uri', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/radius/../utils/os.h	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/nan_supplicant.h	[]	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/os_unix.c	['json']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/wps/../utils/common.h	['p2p', 'scan-res', 'ap-mgmt']	[]
/src/hostap/src/crypto/../utils/wpabuf.h	['tls-client', 'tls-server']	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/crypto_openssl.c	['sae']	[]
/src/hostap/src/crypto/fips_prf_internal.c	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_pkex.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpabuf.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpabuf.c	['pasn-init']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'tls-server', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/notify.c	['scan-res']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/crypto_openssl.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/dh_groups.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.c	['pasn-resp']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/aes-ctr.c	['dpp-uri']	[]
/src/hostap/src/crypto/sha256-internal.c	['tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client', 'p2p', 'tls-server']
/src/hostap/src/ap/../utils/list.h	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wpas_kay.h	[]	[]
/src/hostap/src/tls/tlsv1_cred.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server', 'eapol-supp']
/src/hostap/tests/fuzzing/scan-res/scan-res.c	['scan-res']	['scan-res']
/src/hostap/tests/fuzzing/radius/../../../src/utils/wpa_debug.h	['radius']	[]
/src/hostap/src/ap/authsrv.c	[]	[]
/src/hostap/src/ap/./ap_config.h	['ap-mgmt']	[]
/src/hostap/src/crypto/ms_funcs.c	[]	[]
/src/hostap/src/tls/tlsv1_client_ocsp.c	['tls-client']	[]
/src/hostap/src/wps/wps_registrar.c	[]	[]
/src/hostap/src/utils/bitfield.c	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.c	['wnm']	[]
/src/hostap/src/ap/ieee802_11_ht.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/tls/asn1.c	['x509', 'tls-client', 'tls-server']	['x509', 'tls-client', 'tls-server']
/src/hostap/src/utils/../utils/os.h	['radius', 'dpp-uri', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/ap/vlan_init.c	['ap-mgmt']	[]
/src/hostap/src/eap_common/../utils/wpabuf.h	['eapol-key-supp', 'eapol-supp', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/common/sae.c	['sae']	['sae']
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/crypto_openssl.c	['pasn-init']	[]
/src/hostap/src/ap/../utils/common.h	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bgscan.h	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/config.c	['wnm']	[]
/src/hostap/src/wps/../utils/list.h	[]	[]
/src/hostap/src/tls/pkcs8.c	['tls-server']	['tls-server']
/src/hostap/tests/fuzzing/wnm/../../../src/common/gas_server.h	[]	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpabuf.h	[]	[]
/src/hostap/src/common/ptksa_cache.c	['wnm', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/autoscan.h	[]	[]
/src/hostap/src/tls/pkcs5.c	['tls-server']	[]
/src/hostap/src/ap/accounting.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/asn1/../../../src/utils/common.h	[]	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpabuf.c	[]	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'tls-server', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/utils/base64.c	['tls-server', 'dpp-uri', 'wnm']	['tls-server', 'dpp-uri']
/src/hostap/src/ap/../common/defs.h	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.h	['pasn-init']	[]
/src/hostap/src/ap/pmksa_cache_auth.c	['eapol-key-auth', 'ap-mgmt']	['eapol-key-auth']
/src/hostap/tests/fuzzing/asn1/../../../src/utils/os_unix.c	['asn1']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/ap/interference.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/config_file.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/common.c	['pasn-init']	['sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/ap/ieee802_11_eht.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/common/./ieee802_11_common.h	['p2p', 'eapol-key-supp', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/crypto/sha384-internal.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/pasn_common.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/sha512-kdf.c	['dpp-uri']	[]
/src/hostap/src/tls/tlsv1_server.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server', 'eapol-supp']
/src/hostap/src/p2p/p2p_utils.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/gas_query.c	[]	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wpa_supplicant.c	['scan-res']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/pr_supplicant.h	['wnm']	[]
/src/hostap/src/ap/wpa_auth_ie.c	['eapol-key-auth', 'ap-mgmt']	['eapol-key-auth']
/src/hostap/src/ap/eth_p_oui.c	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha384-prf.c	['pasn-resp']	[]
/src/hostap/src/wps/wps_common.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/wpabuf.h	['eap-aka-peer']	[]
/src/hostap/src/rsn_supp/./wpa_i.h	['eapol-key-supp', 'eapol-supp', 'wnm']	[]
/src/hostap/src/p2p/p2p_pd.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/wpabuf.h	['ml-elems']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha1-prf.c	[]	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/src/crypto/../utils/common.h	['tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/ap/../common/wpa_common.h	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/src/utils/config.c	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/eloop.c	['pasn-resp']	['p2p', 'eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/common/./defs.h	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/radius/./radius.h	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/aes-siv.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/bss.h	['scan-res']	[]
/src/hostap/src/wps/wps_attr_parse.c	['p2p', 'scan-res', 'ap-mgmt']	['p2p']
/src/hostap/src/crypto/./aes_i.h	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpas_kay.h	[]	[]
/src/hostap/src/crypto/sha256-tlsprf.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/tests/fuzzing/wnm/../../../src/utils/common.h	['wnm']	[]
/src/hostap/src/ap/hostapd.c	['ap-mgmt']	[]
/src/hostap/src/ap/drv_callbacks.c	[]	[]
/src/hostap/src/utils/uuid.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wnm_sta.h	['wnm']	[]
/src/hostap/tests/fuzzing/eapol-key-auth/../fuzzer-common.c	['eapol-key-auth']	[]
/src/hostap/src/ap/./wpa_auth.h	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/wpabuf.h	['dpp-uri']	[]
/src/hostap/src/ap/gas_serv.c	[]	[]
/src/hostap/tests/fuzzing/ap-mgmt/../fuzzer-common.c	['ap-mgmt']	[]
/src/hostap/src/utils/./list.h	['p2p', 'eapol-key-supp', 'dpp-uri', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/ap/./hostapd.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/eapol-key-auth/../../../src/drivers/driver_common.c	[]	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../fuzzer-common.c	['eap-mschapv2-peer']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/os_unix.c	['pasn-resp']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp.c	['dpp-uri']	[]
/src/hostap/src/crypto/rc4.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client']
/src/hostap/src/crypto/sha1.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client', 'eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/tests/fuzzing/wnm/wnm.c	['wnm']	['wnm']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/driver_i.h	[]	[]
/src/hostap/tests/fuzzing/tls-server/tls-server.c	['tls-server']	['tls-server']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/dbus/dbus_new.h	['wnm']	[]
/src/hostap/src/ap/ap_mlme.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/crypto_openssl.c	['pasn-resp']	[]
/src/hostap/src/common/ieee802_11_common.c	['p2p', 'eapol-key-supp', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['p2p', 'dpp-uri', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/common.c	['pasn-resp']	['sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/wnm/../../../src/common/defs.h	['wnm']	[]
/src/hostap/src/radius/radius.c	['eapol-key-auth', 'ap-mgmt']	['ap-mgmt']
/src/hostap/src/radius/radius_das.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/sme.h	['wnm']	[]
/src/hostap/src/ap/./fils_hlp.h	[]	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/os_unix.c	['pasn-init']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha256-kdf.c	[]	[]
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/os.h	[]	[]
/src/hostap/src/p2p/../utils/common.h	['p2p']	[]
/src/hostap/src/crypto/dh_groups.c	[]	[]
/src/hostap/src/ap/wpa_auth_ft.c	['eapol-key-auth', 'ap-mgmt']	['eapol-key-auth']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/config_file.c	[]	[]
/src/hostap/src/crypto/aes-ctr.c	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_sim_common.h	[]	[]
/src/hostap/src/crypto/md4-internal.c	[]	[]
/src/hostap/src/crypto/aes-internal-enc.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client', 'eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/src/crypto/des-internal.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/tests/fuzzing/json/../../../src/utils/json.c	['json']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/scan.c	['scan-res']	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['radius', 'eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/rsn_supp/tdls.c	['eapol-key-supp', 'wnm']	['eapol-key-supp']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/list.h	['pasn-init']	[]
/src/hostap/src/wps/wps_dev_attr.c	[]	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/rrm.c	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/common.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/x509/x509.c	['x509']	['x509']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/common.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/os.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/offchannel.c	['wnm']	[]
/src/hostap/src/rsn_supp/../common/defs.h	['eapol-key-supp', 'eapol-supp', 'wnm']	[]
/src/hostap/src/crypto/aes-omac1.c	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['eapol-key-supp', 'eapol-supp']
/src/hostap/tests/fuzzing/eapol-key-supp/eapol-key-supp.c	['eapol-key-supp']	['eapol-key-supp']
/src/hostap/src/wps/wps_enrollee.c	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../fuzzer-common.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha256-prf.c	['pasn-resp']	[]
/src/hostap/src/radius/radius_client.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../../../src/common/gas_server.h	[]	[]
/src/hostap/src/p2p/p2p_sd.c	['p2p']	['p2p']
/src/hostap/src/wps/../utils/wpa_debug.h	['p2p', 'scan-res', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/sha384-kdf.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wps_supplicant.h	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/p2p_supplicant.h	['wnm']	[]
/src/hostap/src/common/wpa_common.c	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/tests/fuzzing/p2p/p2p.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/gas_query.c	['wnm']	[]
/src/hostap/src/ap/dfs.c	['ap-mgmt']	[]
/src/hostap/src/p2p/p2p_go_neg.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/dpp-uri/../fuzzer-common.c	['dpp-uri']	[]
/src/hostap/src/utils/common.c	['sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/sae/../../../src/crypto/sha256-prf.c	[]	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/eap_aka.c	['eap-aka-peer']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wnm_sta.h	[]	[]
/src/hostap/src/tls/../utils/os.h	['x509', 'tls-client', 'tls-server']	[]
/src/hostap/src/utils/json.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/scan-res/../../../src/common/defs.h	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/events.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpa_debug.h	['pasn-resp']	[]
/src/hostap/src/crypto/aes-encblock.c	[]	[]
/src/hostap/src/crypto/crypto_internal-cipher.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/interworking.c	[]	[]
/src/hostap/src/tls/./asn1.h	['x509', 'tls-client', 'tls-server']	[]
/src/hostap/src/crypto/sha1-pbkdf2.c	['tls-server', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/tls/pkcs1.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/tests/fuzzing/pasn-init/pasn-init.c	['pasn-init']	['pasn-init']
/src/hostap/tests/fuzzing/scan-res/../../../src/utils/os.h	['scan-res']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/tls/asn1.h	['dpp-uri']	[]
/src/hostap/src/eap_common/../utils/common.h	['eapol-key-supp', 'eapol-supp', 'wnm', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/common.h	['eap-sim-peer']	[]
/src/hostap/src/common/gas.c	['p2p', 'dpp-uri', 'wnm']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../fuzzer-common.c	['eap-aka-peer']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/const_time.h	[]	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wpas_glue.c	[]	[]
/src/hostap/src/common/../utils/wpabuf.h	['sae', 'p2p', 'eapol-key-supp', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/tls/bignum.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server']
/src/hostap/src/ap/ndisc_snoop.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/common.h	['eap-mschapv2-peer']	[]
/src/hostap/tests/fuzzing/x509/../fuzzer-common.c	['x509']	[]
/src/hostap/tests/fuzzing/eapol-supp/eapol-supp.c	['eapol-supp']	['eapol-supp']
/src/hostap/src/crypto/sha256.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client']
/src/hostap/tests/fuzzing/eapol-key-auth/eapol-key-auth.c	['eapol-key-auth']	['eapol-key-auth']
/src/hostap/src/ap/./mbo_ap.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/tls-client/tls-client.c	['tls-client']	['tls-client']
/src/hostap/src/ap/ieee802_11_shared.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/rrm.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/pasn_common.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/pasn_responder.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/scan.c	['wnm']	[]
/src/hostap/src/ap/neighbor_db.c	[]	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/sae.c	['pasn-init']	['sae']
/src/hostap/tests/fuzzing/scan-res/../../../src/utils/wpa_debug.h	[]	[]
/src/hostap/tests/fuzzing/tls-server/../../../src/utils/wpa_debug.h	['tls-server']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/hs20_supplicant.c	[]	[]
/src/hostap/src/utils/./os.h	['p2p', 'eapol-key-supp', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/eap_server/../utils/wpabuf.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/radius/../fuzzer-common.c	['radius']	[]
/src/hostap/tests/fuzzing/asn1/asn1.c	['asn1']	['asn1']
/src/hostap/src/crypto/sha1-internal.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth']
/src/hostap/src/ap/ap_list.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/ap/../radius/radius.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.h	['pasn-resp']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/os.h	['pasn-resp']	[]
/src/hostap/src/common/../utils/const_time.h	[]	[]
/src/hostap/tests/fuzzing/json/../../../src/utils/wpabuf.h	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/tls/asn1.c	['dpp-uri']	['x509', 'tls-client', 'tls-server']
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/common.c	[]	['sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/ap/ieee802_11_uhr.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/defs.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/bgscan.h	[]	[]
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/wpa_debug.c	['ml-elems']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_reconfig.c	['dpp-uri']	[]
/src/hostap/src/ap/utils.c	['ap-mgmt']	[]
/src/hostap/src/utils/crc32.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha384-prf.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/wpabuf.h	['wnm']	[]
/src/hostap/src/eap_peer/eap.c	['eapol-key-supp', 'eapol-supp', 'scan-res', 'wnm']	['eapol-supp']
/src/hostap/src/tls/tlsv1_client_write.c	['tls-client']	['tls-client']
/src/hostap/src/wps/ndef.c	[]	[]
/src/hostap/tests/fuzzing/ml-elems/../fuzzer-common.c	['ml-elems']	[]
/src/hostap/tests/fuzzing/pasn-init/../fuzzer-common.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/driver_i.h	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/interworking.c	['wnm']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_tcp.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant_i.h	['wnm']	[]
/src/hostap/src/ap/./sta_info.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/sme.h	[]	[]
/src/hostap/src/ap/vlan.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/dbus/dbus_new.h	['scan-res']	[]
/src/hostap/src/crypto/../utils/os.h	['radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/p2p/p2p_group.c	['p2p']	[]
/src/hostap/src/eapol_supp/eapol_supp_sm.c	['eapol-key-supp', 'eapol-supp', 'wnm']	['eapol-key-supp', 'eapol-supp']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_crypto.c	['dpp-uri']	[]
/src/hostap/src/ap/eap_user_db.c	[]	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/eap_mschapv2.c	['eap-mschapv2-peer']	[]
/src/hostap/src/ap/wpa_auth.c	['eapol-key-auth', 'ap-mgmt']	['eapol-key-auth', 'ap-mgmt']
/src/hostap/tests/fuzzing/eap-sim-peer/../fuzzer-common.c	['eap-sim-peer']	[]
/src/hostap/src/ap/../utils/wpabuf.h	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/asn1/../../../src/utils/os.h	['asn1']	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_common/eap_common.c	[]	['eapol-supp']
/src/hostap/tests/fuzzing/json/../../../src/utils/base64.c	[]	['tls-server', 'dpp-uri']
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/wpa_debug.h	['eap-sim-peer']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/const_time.h	[]	[]
/src/hostap/src/ap/./ieee802_11.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/dragonfly.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/bssid_ignore.c	[]	[]
/src/hostap/src/rsn_supp/wpa_ie.c	['eapol-key-supp', 'eapol-supp', 'wnm']	['eapol-key-supp', 'eapol-supp']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/autoscan.h	['wnm']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/robust_av.c	[]	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/eap_register.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/nan_supplicant.h	['wnm']	[]
/src/hostap/src/p2p/p2p_dev_disc.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/json/../../../src/utils/wpa_debug.c	['json']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/pr_supplicant.h	[]	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/pasn_common.c	['pasn-resp']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bss.h	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/eapol_supp/eapol_supp_sm.h	['pasn-init']	[]
/src/hostap/tests/fuzzing/pasn-resp/pasn-resp.c	['pasn-resp']	['pasn-resp']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/const_time.h	[]	[]
/src/hostap/src/rsn_supp/pmksa_cache.c	['eapol-key-supp', 'eapol-supp', 'wnm']	['eapol-key-supp', 'eapol-supp']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wmm_ac.c	[]	[]
/src/hostap/src/ap/x_snoop.c	[]	[]
/src/hostap/tests/fuzzing/radius/../../../src/utils/wpabuf.h	['radius']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/list.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/drivers/driver_common.c	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/notify.c	['wnm']	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_common/eap_common.c	[]	['eapol-supp']
/src/hostap/tests/fuzzing/scan-res/../../../src/utils/wpabuf.h	['scan-res']	[]
/usr/include/openssl/x509.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/sha384-kdf.c	[]	[]
/src/hostap/src/utils/./wpabuf.h	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/src/crypto/sha512-internal.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/src/p2p/../utils/os.h	['p2p']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/dh_groups.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/os.h	['wnm']	[]
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/wpabuf.c	['ml-elems']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'tls-server', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/rsn_supp/preauth.c	['eapol-key-supp', 'eapol-supp', 'wnm']	[]
/src/hostap/src/common/../utils/common.h	['sae', 'p2p', 'eapol-key-supp', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/wpa_debug.h	['dpp-uri']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha256-kdf.c	[]	[]
/src/hostap/src/crypto/aes-internal-dec.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['tls-client', 'eapol-key-supp', 'eapol-key-auth']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/ieee802_11_common.c	['pasn-resp']	['p2p', 'dpp-uri', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bss.c	['wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wmm_ac.c	['wnm']	[]
/src/hostap/src/utils/eloop.c	['p2p', 'eapol-key-supp', 'dpp-uri', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['p2p', 'eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/crypto/crypto_internal-rsa.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server']
/src/hostap/src/rsn_supp/wpa_ft.c	['eapol-key-supp', 'eapol-supp', 'wnm']	['eapol-key-supp']
/src/hostap/src/ap/vlan_ifconfig.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/scan-res/../fuzzer-common.c	['scan-res']	[]
/src/hostap/src/ap/robust_av.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/crypto/sha1-tlsprf.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/src/eap_server/eap_server_methods.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpas_glue.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/wpa_common.c	['pasn-resp']	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/tests/fuzzing/ap-mgmt/../../../src/drivers/driver_common.c	[]	[]
/src/hostap/src/ap/rrm.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/sha256-kdf.c	['dpp-uri']	[]
/src/hostap/src/ap/bss_load.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/wpa_debug.h	['wnm']	[]
/src/hostap/tests/fuzzing/sae/../../../src/utils/wpa_debug.h	[]	[]
/src/hostap/tests/fuzzing/radius/../../../src/utils/common.h	['radius']	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/dh_groups.c	['sae']	[]
/src/hostap/src/ap/dhcp_snoop.c	[]	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/pmksa_cache.c	['pasn-init']	['eapol-key-supp', 'eapol-supp']
/src/hostap/src/ap/wps_hostapd.c	['ap-mgmt']	[]
/src/hostap/src/ap/ieee802_11_vht.c	['ap-mgmt']	[]
/src/hostap/src/ap/wmm.c	['ap-mgmt']	[]
/src/hostap/src/ap/ieee802_11_auth.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/ctrl_iface.h	[]	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/wpa_debug.c	['pasn-init']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/json/../../../src/utils/os.h	['json']	[]
/src/hostap/tests/fuzzing/asn1/../../../src/tls/asn1.c	['asn1']	['x509', 'tls-client', 'tls-server']
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/eloop.c	['pasn-init']	['p2p', 'eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wps_supplicant.c	[]	[]
/src/hostap/src/tls/rsa.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server']
/src/hostap/tests/fuzzing/scan-res/../../../src/drivers/driver_common.c	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../src/utils/list.h	['wnm']	[]
/src/hostap/src/ap/../utils/os.h	['ap-mgmt']	[]
/src/hostap/src/eap_peer/eap_methods.c	['eapol-key-supp', 'eapol-supp', 'wnm']	['eapol-supp']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/common.h	['pasn-resp']	[]
/src/hostap/src/wps/./wps.h	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../src/eap_peer/eap_methods.h	[]	[]
/src/hostap/src/crypto/dh_group5.c	[]	[]
/src/hostap/src/tls/tlsv1_client_read.c	['tls-client']	['tls-client']
/src/hostap/tests/fuzzing/tls-server/../fuzzer-common.c	['tls-server']	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpa_debug.h	['eap-mschapv2-peer']	[]
/src/hostap/src/tls/../utils/wpabuf.h	['tls-client', 'tls-server']	[]
/src/hostap/src/utils/wpabuf.c	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'tls-server', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/utils/ip_addr.c	['dpp-uri', 'ap-mgmt']	['dpp-uri']
/src/hostap/src/l2_packet/../utils/common.h	['eapol-key-supp', 'eapol-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/wpa_common.c	['pasn-init']	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/src/tls/tlsv1_client.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server', 'eapol-supp']
/src/hostap/tests/fuzzing/radius/radius.c	['radius']	['radius']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_auth.c	['dpp-uri']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/events.c	[]	[]
/src/hostap/tests/fuzzing/eapol-supp/../fuzzer-common.c	['eapol-supp']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/op_classes.c	[]	[]
/src/hostap/src/ap/ieee802_11.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/ap/beacon.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/dpp_backup.c	['dpp-uri']	[]
/src/hostap/src/tls/./libtommath.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	[]
/src/hostap/src/wps/../utils/os.h	['p2p']	[]
/src/hostap/src/common/hw_features_common.c	['wnm', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.c	['pasn-resp']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'radius', 'tls-client', 'p2p', 'tls-server', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/eap_register.c	[]	[]
/src/hostap/src/ap/airtime_policy.c	[]	[]
/src/hostap/tests/fuzzing/tls-client/../../../src/utils/wpa_debug.h	['tls-client']	[]
/src/hostap/tests/fuzzing/sae/../../../src/common/dragonfly.c	['sae']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/offchannel.c	[]	[]
/src/hostap/src/tls/tlsv1_server_read.c	['tls-server']	[]
/src/hostap/src/ap/wpa_auth_glue.c	[]	[]
/src/hostap/src/p2p/../utils/list.h	['p2p']	[]
/src/hostap/src/ap/ieee802_1x.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/ap/hw_features.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_sim_common.c	[]	[]
/src/hostap/src/l2_packet/l2_packet_linux.c	['eapol-key-supp', 'eapol-supp', 'wnm']	[]
/src/hostap/src/eap_common/eap_common.c	['eapol-key-supp', 'eapol-supp', 'wnm', 'ap-mgmt']	['eapol-supp']
/src/hostap/tests/fuzzing/asn1/../../../src/utils/wpa_debug.c	['asn1']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/rsn_supp/../utils/wpabuf.h	[]	[]
/src/hostap/src/ap/../common/ieee802_11_defs.h	['ap-mgmt']	[]
/src/hostap/src/ap/./acs.h	[]	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/p2p_supplicant.h	[]	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/robust_av.c	['wnm']	[]
/src/hostap/src/rsn_supp/../utils/common.h	['eapol-key-supp', 'eapol-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/hs20_supplicant.c	['wnm']	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/eap_sim.c	['eap-sim-peer']	[]
/src/hostap/tests/fuzzing/sae/sae.c	['sae']	['sae']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/dragonfly.c	['pasn-resp']	[]
/src/hostap/src/common/../utils/list.h	['wnm', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/eapol-key-supp/../fuzzer-common.c	['eapol-key-supp']	[]
/src/hostap/src/crypto/md5.c	['radius', 'tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['radius', 'tls-client']
/src/hostap/tests/fuzzing/asn1/../../../src/utils/common.c	[]	['sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/common.h	['eap-aka-peer']	[]
/src/hostap/tests/fuzzing/eap-aka-peer/eap-aka-peer.c	['eap-aka-peer']	['eap-aka-peer']
/src/hostap/tests/fuzzing/ml-elems/../../../src/common/ieee802_11_common.h	['ml-elems']	[]
/src/hostap/src/rsn_supp/../rsn_supp/wpa_i.h	['eapol-key-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/wnm/../fuzzer-common.c	['wnm']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_i.h	['pasn-init']	[]
/src/hostap/src/utils/wpa_debug.c	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/crypto/../utils/wpa_debug.h	[]	[]
/src/hostap/tests/fuzzing/scan-res/../../../src/utils/common.h	['scan-res']	[]
/src/hostap/src/p2p/p2p_invitation.c	['p2p']	['p2p']
/src/hostap/src/ap/tkip_countermeasures.c	[]	[]
/src/hostap/tests/fuzzing/scan-res/../../../src/utils/list.h	['scan-res']	[]
/src/hostap/src/ap/./ap_drv_ops.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-resp/../../../src/ap/comeback_token.c	['pasn-resp']	[]
/src/hostap/src/utils/os_unix.c	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/common.h	['ml-elems']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/pasn_initiator.c	['pasn-init']	[]
/src/hostap/tests/fuzzing/asn1/../fuzzer-common.c	['asn1']	[]
/src/hostap/src/ap/hs20.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/asn1/../../../src/tls/asn1.h	['asn1']	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/wpabuf.h	['eap-mschapv2-peer']	[]
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/os_unix.c	['ml-elems']	['eap-sim-peer', 'eap-aka-peer', 'eap-mschapv2-peer', 'sae', 'x509', 'radius', 'tls-client', 'p2p', 'eapol-key-supp', 'tls-server', 'dpp-uri', 'eapol-supp', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/crypto/aes-cbc.c	[]	[]
/src/hostap/src/p2p/p2p.c	['p2p']	['p2p']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wnm_sta.c	[]	[]
/src/hostap/tests/fuzzing/sae/../../../src/crypto/sha256-kdf.c	[]	[]
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/eap_common.c	[]	['eapol-supp']
/src/hostap/tests/fuzzing/tls-client/../fuzzer-common.c	['tls-client']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/ctrl_iface.h	[]	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/wpabuf.h	['eap-sim-peer']	[]
/src/hostap/tests/fuzzing/ml-elems/ml-elems.c	['ml-elems']	['ml-elems']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/mbo.c	[]	[]
/src/hostap/src/ap/sta_info.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/json/json.c	['json']	['json']
/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/wpa_ie.c	['pasn-init']	['eapol-key-supp', 'eapol-supp']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/wpabuf.h	['pasn-resp']	[]
/src/hostap/tests/fuzzing/eap-sim-peer/eap-sim-peer.c	['eap-sim-peer']	['eap-sim-peer']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/bssid_ignore.c	['wnm']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/bss.c	['scan-res']	[]
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/wpa_supplicant_i.h	[]	[]
/src/hostap/src/crypto/aes-unwrap.c	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['eapol-key-supp', 'eapol-key-auth']
/src/hostap/src/ap/ap_drv_ops.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/wps/wps_attr_build.c	['p2p', 'ap-mgmt']	['p2p']
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/wpa_debug.h	['eap-aka-peer']	[]
/src/hostap/src/crypto/aes-siv.c	['eapol-key-auth', 'ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha1-prf.c	[]	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/src/crypto/sha1-prf.c	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['eapol-key-supp', 'eapol-supp', 'eapol-key-auth']
/src/hostap/src/crypto/crypto_internal.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server', 'eapol-supp']
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/mesh_mpm.h	[]	[]
/src/hostap/src/crypto/aes-wrap.c	['eapol-key-auth', 'ap-mgmt']	['eapol-key-auth']
/src/hostap/src/ap/ap_config.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/src/wps/wps_attr_process.c	[]	[]
/src/hostap/src/eapol_auth/eapol_auth_sm.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/ap-mgmt/ap-mgmt.c	['ap-mgmt']	['ap-mgmt']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/defs.h	['pasn-resp']	[]
/src/hostap/src/eap_server/eap_server.c	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/sha256-prf.c	['pasn-init']	[]
/src/hostap/src/p2p/../utils/wpabuf.h	['p2p']	[]
/src/hostap/src/rsn_supp/../common/wpa_common.h	['eapol-key-supp', 'eapol-supp', 'wnm']	[]
/src/hostap/tests/fuzzing/json/../fuzzer-common.c	['json']	[]
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/mesh_mpm.h	['wnm']	[]
/src/hostap/src/crypto/md5-internal.c	['radius', 'tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'eapol-key-auth', 'wnm', 'ap-mgmt']	['radius', 'tls-client', 'tls-server']
/src/hostap/src/crypto/tls_internal.c	['tls-client', 'eapol-key-supp', 'tls-server', 'eapol-supp', 'wnm']	['tls-client', 'tls-server', 'eapol-supp']
/src/hostap/src/ap/../wps/wps.h	['ap-mgmt']	[]
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/ieee802_11_common.c	['pasn-init']	['p2p', 'dpp-uri', 'scan-res', 'eapol-key-auth', 'wnm', 'ap-mgmt']
/src/hostap/src/ap/./wpa_auth_kay.h	[]	[]
/src/hostap/tests/fuzzing/dpp-uri/dpp-uri.c	['dpp-uri']	['dpp-uri']
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/list.h	['pasn-resp']	[]
/src/hostap/src/crypto/crypto_internal-modexp.c	['tls-client', 'tls-server']	['tls-client']
/src/hostap/tests/fuzzing/p2p/../fuzzer-common.c	['p2p']	[]
/src/hostap/src/rsn_supp/wpa.c	['eapol-key-supp', 'eapol-supp', 'wnm']	['eapol-key-supp', 'eapol-supp', 'wnm']
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/wpa_supplicant.c	['wnm']	[]
/src/hostap/src/eap_peer/../utils/os.h	[]	[]
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/mschapv2.c	[]	[]
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_common/eap_sim_common.c	[]	[]

Directories in report

Directory
/src/hostap/src/crypto/
/src/hostap/tests/fuzzing/scan-res/../../../src/drivers/
/src/hostap/src/wps/../utils/
/src/hostap/tests/fuzzing/radius/
/src/hostap/src/crypto/../utils/
/src/hostap/tests/fuzzing/asn1/../../../src/tls/
/src/hostap/src/rsn_supp/./
/src/hostap/tests/fuzzing/radius/../
/src/hostap/src/eap_peer/
/src/hostap/tests/fuzzing/ap-mgmt/../
/src/hostap/tests/fuzzing/tls-client/
/src/hostap/tests/fuzzing/tls-client/../../../src/utils/
/src/hostap/src/rsn_supp/../common/
/src/hostap/src/wps/./
/src/hostap/src/eap_peer/../utils/
/src/hostap/tests/fuzzing/json/../
/src/hostap/tests/fuzzing/eap-sim-peer/
/src/hostap/tests/fuzzing/dpp-uri/../../../src/tls/
/src/hostap/src/eap_server/../utils/
/src/hostap/src/common/./
/src/hostap/src/common/../utils/
/src/hostap/tests/fuzzing/scan-res/
/src/hostap/tests/fuzzing/asn1/../
/src/hostap/tests/fuzzing/scan-res/../../../src/utils/
/src/hostap/tests/fuzzing/pasn-init/../../../src/rsn_supp/
/src/hostap/tests/fuzzing/tls-server/../
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/
/src/hostap/src/utils/./
/src/hostap/src/ap/./
/src/hostap/src/radius/./
/src/hostap/src/eap_common/../utils/
/src/hostap/tests/fuzzing/eapol-key-supp/../
/src/hostap/tests/fuzzing/dpp-uri/
/src/hostap/tests/fuzzing/ml-elems/
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_peer/
/src/hostap/src/eapol_auth/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/utils/
/src/hostap/tests/fuzzing/sae/../../../src/crypto/
/src/hostap/tests/fuzzing/wnm/../../../src/eap_peer/
/src/hostap/tests/fuzzing/json/../../../src/utils/
/src/hostap/tests/fuzzing/ml-elems/../../../src/utils/
/src/hostap/src/tls/./
/src/hostap/tests/fuzzing/eapol-supp/../
/src/hostap/tests/fuzzing/scan-res/../
/src/hostap/tests/fuzzing/pasn-resp/../../../src/crypto/
/src/hostap/src/rsn_supp/../rsn_supp/
/src/hostap/src/utils/
/src/hostap/src/common/
/src/hostap/src/crypto/./
/src/hostap/tests/fuzzing/dpp-uri/../
/src/hostap/tests/fuzzing/sae/
/src/hostap/tests/fuzzing/wnm/../../../src/utils/
/src/hostap/tests/fuzzing/eapol-key-supp/
/src/hostap/tests/fuzzing/wnm/../../../src/common/
/src/hostap/src/ap/../radius/
/src/hostap/tests/fuzzing/tls-client/../
/src/hostap/tests/fuzzing/p2p/../
/src/hostap/src/tls/../utils/
/src/hostap/tests/fuzzing/pasn-init/../../../src/eapol_supp/
/src/hostap/tests/fuzzing/radius/../../../src/radius/
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/utils/
/src/hostap/src/rsn_supp/../utils/
/src/hostap/tests/fuzzing/x509/
/src/hostap/tests/fuzzing/x509/../
/src/hostap/tests/fuzzing/json/
/src/hostap/tests/fuzzing/ml-elems/../
/src/hostap/tests/fuzzing/pasn-resp/../../../src/common/
/src/hostap/tests/fuzzing/wnm/
/src/hostap/tests/fuzzing/pasn-resp/../../../src/ap/
/src/hostap/tests/fuzzing/asn1/../../../src/utils/
/usr/include/openssl/
/src/hostap/src/wps/
/src/hostap/src/eap_common/
/src/hostap/tests/fuzzing/radius/../../../src/utils/
/src/hostap/src/p2p/../utils/
/src/hostap/tests/fuzzing/asn1/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_common/
/src/hostap/tests/fuzzing/sae/../../../src/common/
/src/hostap/tests/fuzzing/scan-res/../../../src/common/
/src/hostap/src/ap/
/src/hostap/tests/fuzzing/pasn-resp/../../../src/pasn/
/src/hostap/tests/fuzzing/pasn-init/../../../src/utils/
/src/hostap/tests/fuzzing/eapol-key-auth/../../../src/drivers/
/src/hostap/tests/fuzzing/eap-aka-peer/../
/src/hostap/tests/fuzzing/p2p/
/src/hostap/tests/fuzzing/eap-aka-peer/
/src/hostap/tests/fuzzing/eap-sim-peer/../
/src/hostap/tests/fuzzing/wnm/../
/src/hostap/tests/fuzzing/ml-elems/../../../src/common/
/src/hostap/tests/fuzzing/pasn-init/../../../src/common/
/src/hostap/tests/fuzzing/eapol-key-auth/../
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../../../src/eap_peer/
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/utils/
/src/hostap/src/eapol_supp/
/src/hostap/src/tls/
/src/hostap/src/radius/../utils/
/src/hostap/tests/fuzzing/pasn-resp/../../../src/utils/
/src/hostap/src/ap/../utils/
/src/hostap/src/utils/../utils/
/src/hostap/tests/fuzzing/tls-server/
/src/hostap/src/ap/../common/
/src/hostap/src/ap/../wps/
/src/hostap/tests/fuzzing/pasn-init/../../../src/crypto/
/src/hostap/tests/fuzzing/sae/../../../src/utils/
/src/hostap/tests/fuzzing/eapol-key-auth/
/src/hostap/tests/fuzzing/pasn-resp/../
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_peer/
/src/hostap/tests/fuzzing/ap-mgmt/
/src/hostap/tests/fuzzing/scan-res/../../../src/eap_peer/
/src/hostap/tests/fuzzing/eapol-supp/
/src/hostap/tests/fuzzing/eap-mschapv2-peer/../
/src/hostap/tests/fuzzing/eap-aka-peer/../../../src/eap_common/
/src/hostap/tests/fuzzing/dpp-uri/../../../src/crypto/
/src/hostap/src/l2_packet/
/usr/include/x86_64-linux-gnu/bits/
/src/hostap/src/p2p/
/src/hostap/src/l2_packet/../utils/
/src/hostap/tests/fuzzing/tls-server/../../../src/utils/
/src/hostap/tests/fuzzing/wnm/../../../src/drivers/
/src/hostap/tests/fuzzing/wnm/../../../wpa_supplicant/dbus/
/src/hostap/src/eap_server/
/src/hostap/tests/fuzzing/ap-mgmt/../../../src/drivers/
/src/hostap/tests/fuzzing/sae/../
/src/hostap/tests/fuzzing/pasn-resp/
/src/hostap/tests/fuzzing/pasn-init/../
/src/hostap/src/rsn_supp/
/src/hostap/tests/fuzzing/pasn-init/
/src/hostap/tests/fuzzing/eap-sim-peer/../../../src/eap_common/
/src/hostap/tests/fuzzing/dpp-uri/../../../src/utils/
/src/hostap/tests/fuzzing/pasn-init/../../../src/pasn/
/src/hostap/tests/fuzzing/scan-res/../../../wpa_supplicant/dbus/
/src/hostap/src/radius/
/src/hostap/tests/fuzzing/dpp-uri/../../../src/common/