Fuzz introspector: sshsigopt_fuzz
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 2 2 opt_flag call site: 00005 /src/hpn-ssh/misc.c:2610
0 0 None 0 3 sshsigopt_parse call site: 00029 /src/hpn-ssh/sshsig.c:720
0 0 None 0 0 opt_dequote call site: 00013 /src/hpn-ssh/misc.c:2634
0 0 None 0 0 sshsigopt_parse call site: 00002 /src/hpn-ssh/sshsig.c:648

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 sshsigopt_parse [function] [call site] 00001
2 calloc [call site] 00002
2 opt_flag [function] [call site] 00003
3 strlen [call site] 00004
3 strncasecmp [call site] 00005
3 strncasecmp [call site] 00006
2 opt_match [function] [call site] 00007
3 strlen [call site] 00008
3 strncasecmp [call site] 00009
3 strlen [call site] 00010
3 strlen [call site] 00011
2 opt_dequote [function] [call site] 00012
3 strlen [call site] 00013
2 opt_match [function] [call site] 00014
2 opt_dequote [function] [call site] 00015
2 parse_absolute_time [function] [call site] 00016
3 strlen [call site] 00017
3 strcasecmp [call site] 00018
3 strcasecmp [call site] 00019
3 snprintf [call site] 00020
3 snprintf [call site] 00021
3 snprintf [call site] 00022
3 memset [call site] 00023
3 strptime [call site] 00024
3 timegm [call site] 00025
3 mktime [call site] 00026
2 opt_match [function] [call site] 00027
2 opt_dequote [function] [call site] 00028
2 parse_absolute_time [function] [call site] 00029
2 sshsigopt_free [function] [call site] 00030
1 sshsigopt_free [function] [call site] 00031