High level conclusions

Fuzzer fuzz_attrset is blocked:

The runtime code coverage of fuzz_attrset covers 29.13% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_asn is blocked:

The runtime code coverage of fuzz_asn covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_chpw is blocked:

The runtime code coverage of fuzz_chpw covers 28.57% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_kdc is blocked:

The runtime code coverage of fuzz_kdc covers 28.34% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_krb is blocked:

The runtime code coverage of fuzz_krb covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_json is blocked:

The runtime code coverage of fuzz_json covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 26.14% of cyclomatic complexity.

Fuzzers reach 26.54% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

805 / 3033

Cyclomatic complexity statically reachable by fuzzers

5073 / 19405

Runtime code coverage of functions

681 / 3033

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_profile

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	10.0%
gold	[1:9]	8	7.27%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	91	82.7%
All colors	110	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4	4	1 : View List ['strcmp']	4	4	profile_find_node	call site: 00087	/src/krb5/src/util/profile/prof_tree.c:358
2	15	3 : View List ['skip_over_blanks', 'strdup', 'strip_line']	2	15	parse_line	call site: 00045	/src/krb5/src/util/profile/prof_parse.c:317
2	2	1 : View List ['strerror']	2	2	k5_mutex_lock	call site: 00019	/src/krb5/src/util/support/../../include/k5-thread.h:371
2	2	1 : View List ['strerror']	2	2	k5_mutex_unlock	call site: 00027	/src/krb5/src/util/support/../../include/k5-thread.h:383
0	6	1 : View List ['profile_free_node']	0	6	profile_create_node	call site: 00038	/src/krb5/src/util/profile/prof_tree.c:105
0	0	None	12	12	need_double_quotes	call site: 00088	/src/krb5/src/util/profile/prof_parse.c:464
0	0	None	8	8	profile_find_node	call site: 00084	/src/krb5/src/util/profile/prof_tree.c:319
0	0	None	8	8	profile_find_node	call site: 00085	/src/krb5/src/util/profile/prof_tree.c:330
0	0	None	4	114	parse_file	call site: 00040	/src/krb5/src/util/profile/prof_parse.c:348
0	0	None	4	16	profile_create_node	call site: 00034	/src/krb5/src/util/profile/prof_tree.c:93
0	0	None	4	4	profile_find_node	call site: 00086	/src/krb5/src/util/profile/prof_tree.c:347
0	0	None	0	6	profile_create_node	call site: 00035	/src/krb5/src/util/profile/prof_tree.c:99

Runtime coverage analysis

Covered functions

41

Functions that are reachable but not covered

22

Reachable functions

55

Percentage of reachable functions covered

60.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_profile.c	1
util/profile/prof_err.c	1
util/et/error_message.c	1
util/support/threads.c	5
util/et/../../include/k5-thread.h	2
util/profile/prof_parse.c	13
util/profile/prof_tree.c	10

Fuzzer: fuzz_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	146	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	146	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
145	0	EP	call site: 00000	k5_json_decode

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

64

Reachable functions

64

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_json.c	1
tests/fuzzing/../../include/k5-int.h	3
util/support/json.c	37
util/support/k5buf.c	10

Fuzzer: fuzz_ndr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	4.42%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	1.76%
greenyellow	[30:49]	1	0.88%
lawngreen	50+	105	92.9%
All colors	113	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['explicit_bzero']	2	4	k5_buf_free	call site: 00055	/src/krb5/src/util/support/k5buf.c:271
0	11	1 : View List ['k5_buf_free']	0	11	k5_utf16le_to_utf8	call site: 00050	/src/krb5/src/util/support/utf8_conv.c:191
0	2	1 : View List ['set_error']	2	4	ensure_space	call site: 00044	/src/krb5/src/util/support/k5buf.c:90
0	2	1 : View List ['set_error']	0	2	k5_buf_init_dynamic	call site: 00033	/src/krb5/src/util/support/k5buf.c:129
0	0	None	2	4	ensure_space	call site: 00043	/src/krb5/src/util/support/k5buf.c:78
0	0	None	2	4	ensure_space	call site: 00044	/src/krb5/src/util/support/k5buf.c:83
0	0	None	0	11	k5_utf8_to_utf16le	call site: 00067	/src/krb5/src/util/support/utf8_conv.c:109
0	0	None	0	11	k5_utf8_to_utf16le	call site: 00067	/src/krb5/src/util/support/utf8_conv.c:117
0	0	None	0	4	ndr_dec_delegation_info	call site: 00061	/src/krb5/src/tests/fuzzing/./../../kdc/ndr.c:207
0	0	None	0	2	k5_buf_add_len	call site: 00082	/src/krb5/src/util/support/k5buf.c:153
0	0	None	0	2	k5_buf_cstring	call site: 00052	/src/krb5/src/util/support/k5buf.c:235
0	0	None	0	2	k5_buf_get_space	call site: 00043	/src/krb5/src/util/support/k5buf.c:244

Runtime coverage analysis

Covered functions

37

Functions that are reachable but not covered

4

Reachable functions

41

Percentage of reachable functions covered

90.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_ndr.c	1
tests/fuzzing/../../include/k5-int.h	4
tests/fuzzing/./../../kdc/ndr.c	6
tests/fuzzing/../../include/k5-input.h	6
tests/fuzzing/../../include/k5-platform.h	4
util/support/utf8_conv.c	2
util/support/k5buf.c	10
util/support/../../include/k5-input.h	4
util/support/../../include/k5-platform.h	2
util/support/utf8.c	1
util/support/../../include/k5-buf.h	1
tests/fuzzing/../../include/k5-buf.h	2
lib/krb5/krb/kfree.c	1

Fuzzer: fuzz_des

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.97%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	26	60.4%
lawngreen	50+	14	32.5%
All colors	43	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['abort']	2	2	fuzz_des	call site: 00027	/src/krb5/src/tests/fuzzing/fuzz_des.c:58
0	16	2 : View List ['store_32_be', 'load_32_be']	0	16	des_cbc_decrypt	call site: 00023	/src/krb5/src/tests/fuzzing/./../../lib/crypto/builtin/des/f_cbc.c:204
0	0	None	0	16	des_cbc_encrypt	call site: 00013	/src/krb5/src/tests/fuzzing/./../../lib/crypto/builtin/des/f_cbc.c:98
0	0	None	0	0	des_cbc_decrypt	call site: 00019	/src/krb5/src/tests/fuzzing/./../../lib/crypto/builtin/des/f_cbc.c:168
0	0	None	0	0	mit_des_cbc_cksum	call site: 00038	/src/krb5/src/lib/crypto/builtin/des/f_cksum.c:84

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

4

Reachable functions

21

Percentage of reachable functions covered

80.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_des.c	4
lib/crypto/builtin/des/key_sched.c	1
lib/crypto/builtin/des/f_sched.c	1
lib/crypto/builtin/des/../../../../include/k5-platform.h	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
lib/crypto/builtin/des/f_parity.c	1
lib/crypto/builtin/des/weak_key.c	1
tests/fuzzing/./../../lib/crypto/builtin/des/f_cbc.c	3
tests/fuzzing/../../include/k5-platform.h	2
tests/fuzzing/../../include/k5-int.h	3
lib/crypto/builtin/des/f_cksum.c	1

Fuzzer: fuzz_aes

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	16.0%
gold	[1:9]	6	6.89%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	4.59%
lawngreen	50+	63	72.4%
All colors	87	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['abort']	2	2	fuzz_aes	call site: 00075	/src/krb5/src/tests/fuzzing/fuzz_aes.c:82
0	0	None	0	608	krb5int_aes_decrypt	call site: 00061	/src/krb5/src/lib/crypto/builtin/enc_provider/aes.c:327
0	0	None	0	608	krb5int_aes_decrypt	call site: 00062	/src/krb5/src/lib/crypto/builtin/enc_provider/aes.c:334
0	0	None	0	596	krb5int_aes_encrypt	call site: 00030	/src/krb5/src/lib/crypto/builtin/enc_provider/aes.c:263
0	0	None	0	596	krb5int_aes_encrypt	call site: 00032	/src/krb5/src/lib/crypto/builtin/enc_provider/aes.c:270
0	0	None	0	21	fuzz_aes	call site: 00007	/src/krb5/src/tests/fuzzing/fuzz_aes.c:57
0	0	None	0	21	fuzz_aes	call site: 00008	/src/krb5/src/tests/fuzzing/fuzz_aes.c:65
0	0	None	0	21	fuzz_aes	call site: 00011	/src/krb5/src/tests/fuzzing/fuzz_aes.c:73
0	0	None	0	21	fuzz_aes	call site: 00045	/src/krb5/src/tests/fuzzing/fuzz_aes.c:77
0	0	None	0	0	krb5int_aes_encrypt	call site: 00012	/src/krb5/src/lib/crypto/builtin/enc_provider/aes.c:247
0	0	None	0	0	krb5int_aes_decrypt	call site: 00046	/src/krb5/src/lib/crypto/builtin/enc_provider/aes.c:310
0	0	None	0	0	k5_iov_cursor_get	call site: 00023	/src/krb5/src/lib/crypto/krb/aead.c:192

Runtime coverage analysis

Covered functions

39

Functions that are reachable but not covered

18

Reachable functions

48

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_aes.c	2
tests/fuzzing/../../include/k5-int.h	4
lib/crypto/krb/key.c	2
lib/crypto/krb/keyblocks.c	2
lib/crypto/builtin/enc_provider/aes.c	8
lib/crypto/builtin/aes/aeskey.c	8
lib/crypto/krb/aead.c	4
lib/crypto/builtin/enc_provider/./../../krb/crypto_int.h	4
lib/crypto/builtin/enc_provider/../../../../include/k5-platform.h	2
lib/crypto/builtin/aes/aescrypt.c	2
lib/crypto/krb/../../../include/k5-int.h	1
lib/crypto/krb/./crypto_int.h	1

Fuzzer: fuzz_marshal_princ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	11.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	88.1%
All colors	59	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['explicit_bzero']	2	4	k5_buf_free	call site: 00055	/src/krb5/src/util/support/k5buf.c:271
0	7	2 : View List ['krb5_free_principal', 'k5_input_set_status']	0	7	unmarshal_princ	call site: 00018	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:181
0	2	1 : View List ['k5_input_set_status']	0	2	get_len_bytes	call site: 00023	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:138
0	2	1 : View List ['set_error']	0	2	k5_buf_init_dynamic	call site: 00033	/src/krb5/src/util/support/k5buf.c:129
0	0	1 : View List ['malloc']	4	6	ensure_space	call site: 00042	/src/krb5/src/util/support/k5buf.c:87
0	0	None	2	4	ensure_space	call site: 00041	/src/krb5/src/util/support/k5buf.c:78
0	0	None	2	4	ensure_space	call site: 00042	/src/krb5/src/util/support/k5buf.c:83
0	0	None	0	2	unmarshal_princ	call site: 00004	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:164
0	0	None	0	2	k5_buf_add_len	call site: 00041	/src/krb5/src/util/support/k5buf.c:153
0	0	None	0	0	k5_buf_free	call site: 00054	/src/krb5/src/util/support/k5buf.c:268
0	0	None	0	0	ensure_space	call site: 00041	/src/krb5/src/util/support/k5buf.c:74

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

5

Reachable functions

36

Percentage of reachable functions covered

86.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_marshal_princ.c	1
lib/krb5/ccache/ccmarshal.c	9
lib/krb5/ccache/../../../include/k5-input.h	5
lib/krb5/ccache/../../../include/k5-int.h	5
lib/krb5/ccache/../../../include/k5-platform.h	4
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
lib/krb5/krb/kfree.c	1
util/support/k5buf.c	6

Fuzzer: fuzz_marshal_cred

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	8.20%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	91.7%
All colors	134	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['explicit_bzero']	2	4	k5_buf_free	call site: 00130	/src/krb5/src/util/support/k5buf.c:271
0	7	2 : View List ['krb5_free_principal', 'k5_input_set_status']	0	7	unmarshal_princ	call site: 00018	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:181
0	2	1 : View List ['k5_input_set_status']	0	2	get_len_bytes	call site: 00023	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:138
0	2	1 : View List ['k5_input_set_status']	0	2	unmarshal_addrs	call site: 00054	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:237
0	2	1 : View List ['k5_input_set_status']	0	2	unmarshal_addr	call site: 00057	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:215
0	2	1 : View List ['k5_input_set_status']	0	2	unmarshal_authdata	call site: 00064	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:275
0	2	1 : View List ['k5_input_set_status']	0	2	unmarshal_authdatum	call site: 00067	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:252
0	2	1 : View List ['set_error']	0	2	k5_buf_init_dynamic	call site: 00082	/src/krb5/src/util/support/k5buf.c:129
0	0	1 : View List ['malloc']	4	6	ensure_space	call site: 00092	/src/krb5/src/util/support/k5buf.c:87
0	0	None	2	4	ensure_space	call site: 00091	/src/krb5/src/util/support/k5buf.c:78
0	0	None	2	4	ensure_space	call site: 00092	/src/krb5/src/util/support/k5buf.c:83
0	0	None	0	2	unmarshal_princ	call site: 00004	/src/krb5/src/lib/krb5/ccache/ccmarshal.c:164

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

6

Reachable functions

61

Percentage of reachable functions covered

90.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_marshal_cred.c	1
lib/krb5/ccache/ccmarshal.c	20
lib/krb5/ccache/../../../include/k5-input.h	8
lib/krb5/ccache/../../../include/k5-int.h	5
lib/krb5/ccache/../../../include/k5-platform.h	8
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
lib/krb5/krb/kfree.c	4
lib/crypto/krb/keyblocks.c	1
lib/crypto/krb/../../../include/k5-int.h	1
lib/krb5/krb/authdata.c	1
util/support/k5buf.c	6

Fuzzer: fuzz_krb

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	882	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	882	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
881	0	EP	call site: 00000	fuzz_enctype_list

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

331

Reachable functions

331

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_krb.c	8
lib/krb5/krb/init_ctx.c	8
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	10
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	2
lib/krb5/krb/kfree.c	4
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	7
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	3
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
tests/fuzzing/../../include/k5-int.h	4
lib/krb5/krb/parse_host_string.c	2
lib/krb5/krb/parse.c	4
lib/krb5/krb/bld_princ.c	4
lib/krb5/krb/conv_princ.c	3
lib/krb5/os/realm_dom.c	1
lib/krb5/krb/str_conv.c	1

Fuzzer: fuzz_kdc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	619	77.6%
gold	[1:9]	10	1.25%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	93	11.6%
lawngreen	50+	75	9.41%
All colors	797	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00695	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
313	313	7 : View List ['fopen', 'profile_free_node', 'profile_parse_file', 'profile_process_directory', 'fcntl', 'fclose', 'fileno']	319	319	profile_update_file_data_locked	call site: 00106	/src/krb5/src/util/profile/prof_file.c:317
155	155	1 : View List ['profile_copy']	155	155	k5_os_init_context	call site: 00017	/src/krb5/src/lib/krb5/os/init_os_ctx.c:434
152	152	1 : View List ['krb5_string_to_deltat']	1189	5492	krb5_init_context_profile	call site: 00682	/src/krb5/src/lib/krb5/krb/init_ctx.c:259
115	115	1 : View List ['write_data_to_file']	115	115	profile_flush_file_data	call site: 00193	/src/krb5/src/util/profile/prof_file.c:509
52	80	7 : View List ['k5_buf_add_len', 'strstr', 'dgettext', 'strchr', 'expand_token', 'krb5_set_error_message', 'free']	52	186	k5_expand_path_tokens_extra	call site: 00700	/src/krb5/src/lib/krb5/os/expand_path.c:496
17	17	1 : View List ['read_entropy_from_device']	17	17	get_os_entropy	call site: 00745	/src/krb5/src/lib/crypto/krb/prng.c:115
16	16	1 : View List ['resize_table']	16	25	k5_hashtab_add	call site: 00763	/src/krb5/src/util/support/hashtab.c:203
8	8	5 : View List ['set_error', 'realloc', 'explicit_bzero', 'malloc', 'free']	8	8	ensure_space	call site: 00334	/src/krb5/src/util/support/k5buf.c:76
7	142	4 : View List ['k5_os_mutex_destroy', 'k5_mutex_lock', 'k5_mutex_unlock', 'krb5int_close_plugin']	7	142	profile_abandon	call site: 00070	/src/krb5/src/util/profile/prof_init.c:480
6	6	3 : View List ['getuid', 'getpwuid_r', 'secure_getenv']	15	828	profile_open_file	call site: 00091	/src/krb5/src/util/profile/prof_file.c:188
6	6	1 : View List ['get_value_vt']	6	6	profile_get_value	call site: 00298	/src/krb5/src/util/profile/prof_get.c:229

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

225

Reachable functions

314

Percentage of reachable functions covered

28.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_kdc.c	1
lib/krb5/krb/init_ctx.c	6
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	10
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	2
lib/krb5/krb/kfree.c	3
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	5
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	1
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
tests/fuzzing/./../../kdc/replay.c	5
tests/fuzzing/../../include/k5-int.h	1
lib/crypto/krb/prng.c	3
util/support/hashtab.c	8
util/support/../../include/k5-platform.h	1
lib/krb5/krb/copy_data.c	1

Fuzzer: fuzz_chpw

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	594	76.4%
gold	[1:9]	11	1.41%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	0.64%
lawngreen	50+	167	21.4%
All colors	777	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00696	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
313	313	7 : View List ['fopen', 'profile_free_node', 'profile_parse_file', 'profile_process_directory', 'fcntl', 'fclose', 'fileno']	319	319	profile_update_file_data_locked	call site: 00107	/src/krb5/src/util/profile/prof_file.c:317
155	155	1 : View List ['profile_copy']	155	155	k5_os_init_context	call site: 00018	/src/krb5/src/lib/krb5/os/init_os_ctx.c:434
152	152	1 : View List ['krb5_string_to_deltat']	1189	5492	krb5_init_context_profile	call site: 00683	/src/krb5/src/lib/krb5/krb/init_ctx.c:259
115	115	1 : View List ['write_data_to_file']	115	115	profile_flush_file_data	call site: 00194	/src/krb5/src/util/profile/prof_file.c:509
52	80	7 : View List ['k5_buf_add_len', 'strstr', 'dgettext', 'strchr', 'expand_token', 'krb5_set_error_message', 'free']	52	186	k5_expand_path_tokens_extra	call site: 00701	/src/krb5/src/lib/krb5/os/expand_path.c:496
7	142	4 : View List ['k5_os_mutex_destroy', 'k5_mutex_lock', 'k5_mutex_unlock', 'krb5int_close_plugin']	7	142	profile_abandon	call site: 00071	/src/krb5/src/util/profile/prof_init.c:480
6	6	3 : View List ['getuid', 'getpwuid_r', 'secure_getenv']	15	828	profile_open_file	call site: 00092	/src/krb5/src/util/profile/prof_file.c:188
6	6	1 : View List ['get_value_vt']	6	6	profile_get_value	call site: 00299	/src/krb5/src/util/profile/prof_get.c:229
4	321	3 : View List ['profile_update_file_data_locked', 'k5_mutex_lock', 'strcmp']	4	511	profile_node_iterator	call site: 00309	/src/krb5/src/util/profile/prof_tree.c:551
4	4	3 : View List ['explicit_bzero', 'strlen', 'free']	4	39	k5_buf_add_vfmt	call site: 00351	/src/krb5/src/util/support/k5buf.c:192
4	4	3 : View List ['explicit_bzero', 'set_error', 'free']	4	4	k5_buf_free	call site: 00355	/src/krb5/src/util/support/k5buf.c:268

Runtime coverage analysis

Covered functions

106

Functions that are reachable but not covered

220

Reachable functions

308

Percentage of reachable functions covered

28.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_chpw.c	1
tests/fuzzing/../../include/k5-int.h	1
lib/krb5/krb/init_ctx.c	6
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	10
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	2
lib/krb5/krb/kfree.c	2
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	5
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	1
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
lib/krb5/krb/chpw.c	3
lib/krb5/krb/../../../include/k5-platform.h	3
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
lib/krb5/unicode/ucstr.c	1
lib/krb5/unicode/../../../include/k5-input.h	3

Fuzzer: fuzz_asn

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1298	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1298	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1297	0	EP	call site: 00000	krb5_init_context

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

486

Reachable functions

486

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_asn.c	3
lib/krb5/krb/init_ctx.c	6
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	10
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	2
lib/krb5/krb/kfree.c	57
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	6
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	1
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
tests/fuzzing/../../include/k5-int.h	1
lib/krb5/asn.1/asn1_k_encode.c	93
lib/krb5/asn.1/asn1_encode.c	40
lib/krb5/asn.1/../../../include/k5-int.h	1
lib/crypto/krb/keyblocks.c	2
lib/krb5/krb/authdata.c	1

Fuzzer: fuzz_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	569	66.0%
gold	[1:9]	10	1.16%
yellow	[10:29]	1	0.11%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	281	32.6%
All colors	861	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2139	2139	5 : View List ['krb5int_open_plugin', 'krb5int_close_plugin', 'krb5int_get_plugin_func', 'krb5int_trace', 'free']	2139	2139	load_if_needed	call site: 00635	/src/krb5/src/lib/krb5/krb/plugin.c:360
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00743	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
313	313	7 : View List ['fopen', 'profile_free_node', 'profile_parse_file', 'profile_process_directory', 'fcntl', 'fclose', 'fileno']	319	319	profile_update_file_data_locked	call site: 00155	/src/krb5/src/util/profile/prof_file.c:317
155	155	1 : View List ['profile_copy']	155	155	k5_os_init_context	call site: 00066	/src/krb5/src/lib/krb5/os/init_os_ctx.c:434
152	152	1 : View List ['krb5_string_to_deltat']	1189	5492	krb5_init_context_profile	call site: 00730	/src/krb5/src/lib/krb5/krb/init_ctx.c:259
115	115	1 : View List ['write_data_to_file']	115	115	profile_flush_file_data	call site: 00242	/src/krb5/src/util/profile/prof_file.c:509
87	87	1 : View List ['make_full_list']	128	140	configure_interface	call site: 00610	/src/krb5/src/lib/krb5/krb/plugin.c:328
52	80	7 : View List ['k5_buf_add_len', 'strstr', 'dgettext', 'strchr', 'expand_token', 'krb5_set_error_message', 'free']	52	186	k5_expand_path_tokens_extra	call site: 00748	/src/krb5/src/lib/krb5/os/expand_path.c:496
23	23	1 : View List ['get_values_vt']	23	23	profile_get_values	call site: 00596	/src/krb5/src/util/profile/prof_get.c:167
21	21	1 : View List ['remove_disabled_modules']	41	53	configure_interface	call site: 00611	/src/krb5/src/lib/krb5/krb/plugin.c:335
16	27	2 : View List ['free_plugin_mapping', 'k5_path_join']	16	27	make_plugin_mapping	call site: 00580	/src/krb5/src/lib/krb5/krb/plugin.c:116
16	16	1 : View List ['resize_table']	16	25	k5_hashtab_add	call site: 00016	/src/krb5/src/util/support/hashtab.c:203

Runtime coverage analysis

Covered functions

166

Functions that are reachable but not covered

200

Reachable functions

339

Percentage of reachable functions covered

41.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_util.c	7
tests/fuzzing/../../include/k5-int.h	3
util/support/base64.c	3
tests/fuzzing/./../../util/support/hashtab.c	7
tests/fuzzing/../../include/k5-platform.h	1
util/support/hex.c	4
lib/krb5/krb/init_ctx.c	6
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	12
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	2
lib/krb5/krb/kfree.c	4
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	7
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	1
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
lib/krb5/krb/parse.c	4
lib/krb5/krb/bld_princ.c	1
lib/krb5/krb/parse_host_string.c	2
util/support/utf8.c	2
util/support/utf8_conv.c	2
util/support/../../include/k5-buf.h	1
util/support/../../include/k5-platform.h	2
util/support/../../include/k5-input.h	4

Fuzzer: fuzz_attrset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	603	78.9%
gold	[1:9]	10	1.30%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	151	19.7%
All colors	764	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00696	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
313	313	7 : View List ['fopen', 'profile_free_node', 'profile_parse_file', 'profile_process_directory', 'fcntl', 'fclose', 'fileno']	319	319	profile_update_file_data_locked	call site: 00107	/src/krb5/src/util/profile/prof_file.c:317
155	155	1 : View List ['profile_copy']	155	155	k5_os_init_context	call site: 00018	/src/krb5/src/lib/krb5/os/init_os_ctx.c:434
152	152	1 : View List ['krb5_string_to_deltat']	1189	5492	krb5_init_context_profile	call site: 00683	/src/krb5/src/lib/krb5/krb/init_ctx.c:259
115	115	1 : View List ['write_data_to_file']	115	115	profile_flush_file_data	call site: 00194	/src/krb5/src/util/profile/prof_file.c:509
52	80	7 : View List ['k5_buf_add_len', 'strstr', 'dgettext', 'strchr', 'expand_token', 'krb5_set_error_message', 'free']	52	186	k5_expand_path_tokens_extra	call site: 00701	/src/krb5/src/lib/krb5/os/expand_path.c:496
9	30	4 : View List ['krb5_k_free_key', 'krb5int_c_free_keyblock_contents', 'find_enctype.3391', 'free']	9	30	krb5_k_free_key	call site: 00000	/src/krb5/src/lib/crypto/krb/key.c:78
8	8	1 : View List ['krb5_k_create_key']	8	73	krb5_c_make_checksum	call site: 00000	/src/krb5/src/lib/crypto/krb/make_checksum.c:91
8	8	5 : View List ['set_error', 'realloc', 'explicit_bzero', 'malloc', 'free']	8	8	ensure_space	call site: 00335	/src/krb5/src/util/support/k5buf.c:76
7	142	4 : View List ['k5_os_mutex_destroy', 'k5_mutex_lock', 'k5_mutex_unlock', 'krb5int_close_plugin']	7	142	profile_abandon	call site: 00071	/src/krb5/src/util/profile/prof_init.c:480
7	7	1 : View List ['krb5int_c_mandatory_cksumtype']	9	22	krb5_k_make_checksum	call site: 00389	/src/krb5/src/lib/crypto/krb/make_checksum.c:43
6	6	3 : View List ['getuid', 'getpwuid_r', 'secure_getenv']	15	828	profile_open_file	call site: 00092	/src/krb5/src/util/profile/prof_file.c:188

Runtime coverage analysis

Covered functions

119

Functions that are reachable but not covered

214

Reachable functions

302

Percentage of reachable functions covered

29.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_attrset.c	1
tests/fuzzing/../../include/k5-int.h	1
lib/krb5/krb/init_ctx.c	6
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	10
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	2
lib/krb5/krb/kfree.c	2
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	5
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	1
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
lib/krad/attrset.c	6
lib/krad/../../include/k5-int.h	1
lib/krad/attr.c	3

Fuzzer: fuzz_crypto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	13.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	97	86.6%
All colors	112	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	17	1 : View List ['read_entropy_from_device']	17	17	get_os_entropy	call site: 00011	/src/krb5/src/lib/crypto/krb/prng.c:115
7	7	1 : View List ['krb5int_c_mandatory_cksumtype']	9	22	krb5_k_make_checksum	call site: 00025	/src/krb5/src/lib/crypto/krb/make_checksum.c:43
7	7	1 : View List ['krb5int_c_mandatory_cksumtype']	7	53	krb5_k_verify_checksum	call site: 00042	/src/krb5/src/lib/crypto/krb/verify_checksum.c:47
2	2	1 : View List ['explicit_bzero']	2	2	krb5_k_decrypt	call site: 00079	/src/krb5/src/lib/crypto/krb/decrypt.c:79
2	2	1 : View List ['explicit_bzero']	2	2	krb5_k_encrypt	call site: 00069	/src/krb5/src/lib/crypto/krb/encrypt.c:73
2	2	1 : View List ['explicit_bzero']	2	2	krb5_c_random_to_key	call site: 00000	/src/krb5/src/lib/crypto/krb/random_to_key.c:58
0	183	5 : View List ['k5_bcmp', 'keyblock_crypt', 'usage_key', 'enc_key', 'krb5int_hmac_keyblock']	0	205	krb5int_arcfour_decrypt	call site: 00000	/src/krb5/src/lib/crypto/krb/enc_rc4.c:280
0	0	None	17	17	get_os_entropy	call site: 00011	/src/krb5/src/lib/crypto/krb/prng.c:110
0	0	None	2	2	mit_des_is_weak_key	call site: 00000	/src/krb5/src/lib/crypto/builtin/des/weak_key.c:83
0	0	None	2	2	cbc_enc	call site: 00000	/src/krb5/src/lib/crypto/builtin/enc_provider/camellia.c:91
0	0	None	2	2	cbc_dec	call site: 00000	/src/krb5/src/lib/crypto/builtin/enc_provider/camellia.c:108
0	0	None	0	608	krb5int_aes_decrypt	call site: 00000	/src/krb5/src/lib/crypto/builtin/enc_provider/aes.c:327

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

14

Reachable functions

52

Percentage of reachable functions covered

73.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_crypto.c	5
tests/fuzzing/../../include/k5-int.h	3
lib/crypto/krb/make_random_key.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	6
lib/crypto/krb/prng.c	3
lib/crypto/krb/make_checksum.c	2
lib/crypto/krb/key.c	2
lib/crypto/krb/keyblocks.c	2
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/verify_checksum.c	2
util/support/bcmp.c	1
lib/krb5/krb/kfree.c	3
lib/crypto/krb/encrypt_length.c	1
lib/crypto/krb/aead.c	1
lib/crypto/krb/encrypt.c	2
lib/crypto/krb/decrypt.c	2
lib/crypto/krb/prf.c	3

Fuzzer: fuzz_krad

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	611	74.5%
gold	[1:9]	10	1.21%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	199	24.2%
All colors	820	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00695	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
313	313	7 : View List ['fopen', 'profile_free_node', 'profile_parse_file', 'profile_process_directory', 'fcntl', 'fclose', 'fileno']	319	319	profile_update_file_data_locked	call site: 00106	/src/krb5/src/util/profile/prof_file.c:317
155	155	1 : View List ['profile_copy']	155	155	k5_os_init_context	call site: 00017	/src/krb5/src/lib/krb5/os/init_os_ctx.c:434
152	152	1 : View List ['krb5_string_to_deltat']	1189	5492	krb5_init_context_profile	call site: 00682	/src/krb5/src/lib/krb5/krb/init_ctx.c:259
115	115	1 : View List ['write_data_to_file']	115	115	profile_flush_file_data	call site: 00193	/src/krb5/src/util/profile/prof_file.c:509
52	80	7 : View List ['k5_buf_add_len', 'strstr', 'dgettext', 'strchr', 'expand_token', 'krb5_set_error_message', 'free']	52	186	k5_expand_path_tokens_extra	call site: 00700	/src/krb5/src/lib/krb5/os/expand_path.c:496
9	30	4 : View List ['krb5_k_free_key', 'krb5int_c_free_keyblock_contents', 'find_enctype.3391', 'free']	9	30	krb5_k_free_key	call site: 00773	/src/krb5/src/lib/crypto/krb/key.c:78
8	8	1 : View List ['krb5_k_create_key']	8	73	krb5_c_make_checksum	call site: 00770	/src/krb5/src/lib/crypto/krb/make_checksum.c:91
8	8	5 : View List ['set_error', 'realloc', 'explicit_bzero', 'malloc', 'free']	8	8	ensure_space	call site: 00334	/src/krb5/src/util/support/k5buf.c:76
7	142	4 : View List ['k5_os_mutex_destroy', 'k5_mutex_lock', 'k5_mutex_unlock', 'krb5int_close_plugin']	7	142	profile_abandon	call site: 00070	/src/krb5/src/util/profile/prof_init.c:480
7	7	1 : View List ['krb5int_c_mandatory_cksumtype']	9	22	krb5_k_make_checksum	call site: 00388	/src/krb5/src/lib/crypto/krb/make_checksum.c:43
6	6	3 : View List ['getuid', 'getpwuid_r', 'secure_getenv']	15	828	profile_open_file	call site: 00091	/src/krb5/src/util/profile/prof_file.c:188

Runtime coverage analysis

Covered functions

135

Functions that are reachable but not covered

216

Reachable functions

323

Percentage of reachable functions covered

33.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_krad.c	2
lib/krb5/krb/init_ctx.c	6
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	10
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	2
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	3
lib/krb5/krb/kfree.c	2
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	5
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	1
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
tests/fuzzing/../../include/k5-int.h	1
lib/krad/packet.c	12
lib/krad/../../include/k5-int.h	3
lib/krad/../../include/k5-platform.h	1
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
lib/krad/attrset.c	5
lib/krad/attr.c	2
lib/crypto/krb/key.c	2
lib/crypto/krb/keyblocks.c	2
util/support/bcmp.c	1
lib/crypto/krb/checksum_hmac_md5.c	1
lib/crypto/builtin/hmac.c	1
lib/crypto/builtin/../../../include/k5-int.h	4

Fuzzer: fuzz_oid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	30	24.5%
gold	[1:9]	24	19.6%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	68	55.7%
All colors	122	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
38	38	2 : View List ['releaseMechInfo', 'strdup']	38	38	gssint_register_mechinfo	call site: 00000	/src/krb5/src/lib/gssapi/mechglue/g_initialize.c:637
4	4	3 : View List ['explicit_bzero', 'strlen', 'free']	15	39	k5_buf_add_vfmt	call site: 00022	/src/krb5/src/util/support/k5buf.c:192
4	4	2 : View List ['mecherrmap__pairarray_max_size', 'realloc']	4	4	mecherrmap__pairarray_grow	call site: 00090	/src/krb5/src/lib/gssapi/generic/./errmap.h:100
4	4	1 : View List ['mecherrmap_destroy']	4	4	gssint_mecherrmap_init	call site: 00000	/src/krb5/src/lib/gssapi/generic/util_errmap.c:147
2	2	1 : View List ['set_error']	2	4	k5_buf_add_vfmt	call site: 00016	/src/krb5/src/util/support/k5buf.c:172
2	2	1 : View List ['strerror']	2	2	k5_mutex_lock	call site: 00053	/src/krb5/src/util/support/../../include/k5-thread.h:371
2	2	1 : View List ['strerror']	2	2	k5_mutex_unlock	call site: 00067	/src/krb5/src/util/support/../../include/k5-thread.h:383
2	2	1 : View List ['abort']	2	2	mecherrmap__pairarray_getaddr	call site: 00062	/src/krb5/src/lib/gssapi/generic/./errmap.h:118
2	2	1 : View List ['set_error']	2	2	k5_buf_init_dynamic	call site: 00003	/src/krb5/src/util/support/k5buf.c:129
0	115	1 : View List ['gssint_mecherrmap_map_errcode']	0	115	gss_oid_to_str	call site: 00002	/src/krb5/src/lib/gssapi/mechglue/g_oid_ops.c:102
0	0	None	152	152	gssint_register_mechinfo	call site: 00000	/src/krb5/src/lib/gssapi/mechglue/g_initialize.c:616
0	0	None	114	114	gssint_register_mechinfo	call site: 00000	/src/krb5/src/lib/gssapi/mechglue/g_initialize.c:623

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

17

Reachable functions

59

Percentage of reachable functions covered

71.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_oid.c	1
lib/gssapi/mechglue/g_oid_ops.c	2
lib/gssapi/generic/oid_ops.c	6
util/support/k5buf.c	10
lib/gssapi/generic/./gssapiP_generic.h	1
lib/gssapi/generic/util_errmap.c	5
lib/gssapi/mechglue/g_initialize.c	2
util/support/threads.c	5
lib/gssapi/generic/../../../include/k5-thread.h	2
lib/gssapi/generic/./errmap.h	9
lib/gssapi/mechglue/g_rel_buffer.c	1
lib/gssapi/mechglue/../../../include/gssapi/gssapi_alloc.h	1
lib/gssapi/mechglue/../../../include/k5-thread.h	2

Fuzzer: fuzz_krb5_ticket

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	823	74.7%
gold	[1:9]	12	1.08%
yellow	[10:29]	5	0.45%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	259	23.5%
All colors	1101	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1671	1676	6 : View List ['krb5_kt_next_entry', 'krb5_free_keytab_entry_contents', 'krb5_free_principal', 'krb5_kt_end_seq_get', 'krb5_copy_principal', 'decrypt_ticket_keyblock']	1671	1676	krb5_server_decrypt_ticket_keytab	call site: 01075	/src/krb5/src/lib/krb5/krb/srv_dec_tkt.c:96
1045	1045	1 : View List ['krb5_kt_get_entry']	2667	2667	krb5_server_decrypt_ticket_keytab	call site: 00947	/src/krb5/src/lib/krb5/krb/srv_dec_tkt.c:81
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00696	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
313	313	7 : View List ['fopen', 'profile_free_node', 'profile_parse_file', 'profile_process_directory', 'fcntl', 'fclose', 'fileno']	319	319	profile_update_file_data_locked	call site: 00107	/src/krb5/src/util/profile/prof_file.c:317
155	155	1 : View List ['profile_copy']	155	155	k5_os_init_context	call site: 00018	/src/krb5/src/lib/krb5/os/init_os_ctx.c:434
152	152	1 : View List ['krb5_string_to_deltat']	1189	5492	krb5_init_context_profile	call site: 00683	/src/krb5/src/lib/krb5/krb/init_ctx.c:259
135	135	14 : View List ['ftell', 'fwrite', 'k5_create_secure_file', 'htons', 'fcntl', 'feof', 'krb5_unlock_file', 'krb5_lock_file', 'fileno', 'setbuf', 'ntohs', 'fopen', 'fread', 'fclose']	147	160	krb5_ktfileint_open	call site: 00000	/src/krb5/src/lib/krb5/keytab/kt_file.c:742
115	115	1 : View List ['write_data_to_file']	115	115	profile_flush_file_data	call site: 00194	/src/krb5/src/util/profile/prof_file.c:509
39	80	7 : View List ['k5_buf_add_len', 'strstr', 'dgettext', 'strchr', 'expand_token', 'krb5_set_error_message', 'free']	39	186	k5_expand_path_tokens_extra	call site: 00701	/src/krb5/src/lib/krb5/os/expand_path.c:496
21	26	5 : View List ['krb5_free_authdata', 'krb5_free_keyblock', 'krb5_free_principal', 'krb5_free_addresses', 'free']	21	26	krb5_free_enc_tkt_part	call site: 01091	/src/krb5/src/lib/krb5/krb/kfree.c:291
8	8	5 : View List ['set_error', 'realloc', 'explicit_bzero', 'malloc', 'free']	8	8	ensure_space	call site: 00335	/src/krb5/src/util/support/k5buf.c:76
7	142	4 : View List ['k5_os_mutex_destroy', 'k5_mutex_lock', 'k5_mutex_unlock', 'krb5int_close_plugin']	7	142	profile_abandon	call site: 00071	/src/krb5/src/util/profile/prof_init.c:480

Runtime coverage analysis

Covered functions

155

Functions that are reachable but not covered

280

Reachable functions

403

Percentage of reachable functions covered

30.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_krb5_ticket.c	1
tests/fuzzing/../../include/k5-int.h	1
lib/krb5/krb/init_ctx.c	11
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	10
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	6
lib/krb5/krb/kfree.c	9
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	4
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	8
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	3
lib/crypto/krb/enctype_util.c	4
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	6
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
lib/krb5/keytab/ktdefault.c	1
lib/krb5/os/ktdefname.c	2
lib/krb5/keytab/ktbase.c	1
lib/krb5/keytab/../../../include/k5-int.h	3
lib/krb5/keytab/../../../include/k5-thread.h	2
lib/krb5/asn.1/asn1_k_encode.c	4
lib/krb5/asn.1/asn1_encode.c	40
lib/krb5/asn.1/../../../include/k5-int.h	1
lib/krb5/krb/srv_dec_tkt.c	2
lib/krb5/krb/decrypt_tk.c	1
lib/krb5/krb/etype_list.c	3
lib/crypto/krb/decrypt.c	2
lib/crypto/krb/key.c	2
lib/crypto/krb/keyblocks.c	3
lib/krb5/krb/chk_trans.c	5
lib/krb5/krb/bld_princ.c	2
lib/krb5/krb/walk_rtree.c	10
lib/krb5/krb/tgtname.c	1
lib/krb5/krb/bld_pr_ext.c	1
lib/krb5/krb/copy_data.c	2
lib/krb5/keytab/ktfr_entry.c	1
lib/krb5/krb/copy_princ.c	1
lib/krb5/krb/authdata.c	1

Fuzzer: fuzz_pac

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	611	70.9%
gold	[1:9]	10	1.16%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.23%
lawngreen	50+	238	27.6%
All colors	861	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1054	1054	3 : View List ['krb5_get_default_realm', 'krb5_realm_compare', 'string2data']	1058	1092	k5_unparse_name	call site: 00518	/src/krb5/src/lib/krb5/krb/unparse.c:149
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00695	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
313	313	7 : View List ['fopen', 'profile_free_node', 'profile_parse_file', 'profile_process_directory', 'fcntl', 'fclose', 'fileno']	319	319	profile_update_file_data_locked	call site: 00106	/src/krb5/src/util/profile/prof_file.c:317
155	155	1 : View List ['profile_copy']	155	155	k5_os_init_context	call site: 00017	/src/krb5/src/lib/krb5/os/init_os_ctx.c:434
152	152	1 : View List ['krb5_string_to_deltat']	1189	5492	krb5_init_context_profile	call site: 00682	/src/krb5/src/lib/krb5/krb/init_ctx.c:259
115	115	1 : View List ['write_data_to_file']	115	115	profile_flush_file_data	call site: 00193	/src/krb5/src/util/profile/prof_file.c:509
52	80	7 : View List ['k5_buf_add_len', 'strstr', 'dgettext', 'strchr', 'expand_token', 'krb5_set_error_message', 'free']	52	186	k5_expand_path_tokens_extra	call site: 00700	/src/krb5/src/lib/krb5/os/expand_path.c:496
15	15	2 : View List ['krb5_set_error_message', 'dgettext']	15	20	krb5_parse_name_flags	call site: 00764	/src/krb5/src/lib/krb5/krb/parse.c:212
7	142	4 : View List ['k5_os_mutex_destroy', 'k5_mutex_lock', 'k5_mutex_unlock', 'krb5int_close_plugin']	7	142	profile_abandon	call site: 00070	/src/krb5/src/util/profile/prof_init.c:480
7	7	1 : View List ['krb5int_c_mandatory_cksumtype']	9	22	krb5_k_make_checksum	call site: 00388	/src/krb5/src/lib/crypto/krb/make_checksum.c:43
7	7	1 : View List ['krb5int_c_mandatory_cksumtype']	7	53	krb5_k_verify_checksum	call site: 00815	/src/krb5/src/lib/crypto/krb/verify_checksum.c:47
6	6	3 : View List ['getuid', 'getpwuid_r', 'secure_getenv']	15	828	profile_open_file	call site: 00091	/src/krb5/src/util/profile/prof_file.c:188

Runtime coverage analysis

Covered functions

156

Functions that are reachable but not covered

209

Reachable functions

337

Percentage of reachable functions covered

37.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pac.c	1
lib/krb5/krb/init_ctx.c	6
lib/krb5/krb5_libinit.c	1
util/support/threads.c	10
lib/krb5/os/init_os_ctx.c	6
util/profile/prof_init.c	9
util/profile/../../include/k5-thread.h	3
util/profile/prof_file.c	16
util/support/strlcpy.c	1
util/profile/prof_tree.c	13
util/support/plugins.c	8
util/profile/prof_parse.c	16
util/support/dir_filenames.c	4
util/support/path.c	2
util/support/errors.c	6
lib/krb5/os/trace.c	13
util/profile/prof_get.c	18
util/support/k5buf.c	11
lib/krb5/os/../../../include/k5-int.h	3
lib/crypto/krb/make_checksum.c	1
lib/crypto/krb/mandatory_sumtype.c	1
lib/crypto/krb/./crypto_int.h	3
lib/crypto/krb/../../../include/k5-int.h	3
lib/krb5/krb/kfree.c	4
lib/krb5/os/../../../include/socket-utils.h	4
lib/krb5/os/addr.c	2
util/support/strerror_r.c	1
lib/krb5/krb/kerrs.c	5
util/et/error_message.c	2
util/et/../../include/k5-thread.h	2
util/et/et_name.c	1
util/support/../../include/k5-thread.h	2
lib/krb5/krb/unparse.c	5
lib/krb5/os/hostrealm.c	9
lib/krb5/krb/plugin.c	17
lib/krb5/krb/../../../include/k5-int.h	8
lib/krb5/os/hostrealm_registry.c	1
lib/krb5/os/hostrealm_profile.c	1
lib/krb5/os/hostrealm_dns.c	1
lib/krb5/os/hostrealm_domain.c	1
lib/krb5/os/c_ustime.c	2
lib/krb5/krb/princ_comp.c	2
lib/crypto/krb/enctype_util.c	1
lib/krb5/ccache/ccfns.c	2
lib/krb5/keytab/ktfns.c	1
lib/krb5/krb/x-deltat.y	2
lib/krb5/krb/deltat.c	2
lib/krb5/os/expand_path.c	5
lib/krb5/krb/preauth2.c	2
lib/krb5/ccache/ccselect.c	2
lib/krb5/os/localauth.c	2
lib/krb5/krb/parse.c	4
lib/krb5/krb/bld_princ.c	1
lib/krb5/krb/pac.c	12
lib/krb5/krb/../../../include/k5-input.h	5
lib/krb5/krb/../../../include/k5-platform.h	3
lib/krb5/krb/copy_data.c	1
lib/crypto/krb/keyed_cksum.c	1
lib/crypto/krb/checksum_length.c	1
lib/crypto/krb/verify_checksum.c	2
lib/crypto/krb/key.c	2
lib/crypto/krb/keyblocks.c	2
util/support/bcmp.c	1
util/support/utf8_conv.c	1
util/support/../../include/k5-input.h	4
util/support/../../include/k5-platform.h	1
util/support/utf8.c	1

Fuzzer: fuzz_gss

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	421	78.1%
gold	[1:9]	31	5.75%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	0.92%
lawngreen	50+	82	15.2%
All colors	539	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
15617	15617	31 : View List ['krb5_auth_con_setaddrs', 'decode_krb5_ap_req', 'ts_interval.3396', 'kg_init_name', 'parse_init_token', 'krb5_rd_req_decoded', 'krb5_auth_con_getremoteseqnumber', 'kg_duplicate_name', 'process_checksum', 'krb5_auth_con_setpermetypes', 'kg_setup_keys', 'krb5_auth_con_set_authdata_context', 'krb5_auth_con_init', 'krb5_auth_con_getlocalseqnumber', 'krb5_auth_con_setflags', 'krb5_auth_con_getflags', 'krb5_merge_authdata', 'krb5_timeofday', 'ts_incr.3395', 'krb5_auth_con_getrecvsubkey_k', 'malloc', 'gssint_g_seqstate_init', 'krb5_auth_con_get_authdata_context', 'kg_cred_resolve', 'krb5_auth_con_getauthenticator', 'krb5_mk_rep', 'make_data.3380', 'krb5_auth_con_getkey_k', 'data_to_gss.3391', 'krb5_auth_con_getsendsubkey_k', 'create_constrained_deleg_creds']	18290	19028	kg_accept_krb5	call site: 00000	/src/krb5/src/lib/gssapi/krb5/accept_sec_context.c:738
3868	3868	2 : View List ['handle_mic', 'acc_ctx_call_acc']	5321	6295	spnego_gss_accept_sec_context	call site: 00000	/src/krb5/src/lib/gssapi/spnego/spnego_mech.c:1640
2158	2158	4 : View List ['krb5_get_server_rcache', 'kg_acceptor_princ', 'k5_change_error_message_code', 'check_keytab']	2160	2164	acquire_accept_cred	call site: 00000	/src/krb5/src/lib/gssapi/krb5/acquire_cred.c:198
1803	1803	1 : View List ['krb5_gss_release_cred']	1803	2188	kg_accept_krb5	call site: 00000	/src/krb5/src/lib/gssapi/krb5/accept_sec_context.c:1238
1717	1717	1 : View List ['krb5int_init_context_kdc']	1717	1717	krb5_gss_init_context	call site: 00000	/src/krb5/src/lib/gssapi/krb5/init_sec_context.c:1011
1666	1750	2 : View List ['kg_accept_dce', 'krb5_gss_save_error_string']	1666	1750	krb5_gss_accept_sec_context_ext	call site: 00000	/src/krb5/src/lib/gssapi/krb5/accept_sec_context.c:1272
1546	2820	9 : View List ['negoex_and_spnego', 'gss_release_oid_set', 'gss_release_cred', 'gss_test_oid_set_member', 'gssspi_query_mechanism_info', 'gssint_mecherrmap_map_errcode', 'gss_create_empty_oid_set', 'gss_add_oid_set_member', 'negoex_add_auth_mech']	1546	2820	get_negotiable_mechs	call site: 00000	/src/krb5/src/lib/gssapi/spnego/spnego_mech.c:3184
1106	1106	1 : View List ['krb5_parse_name']	1108	7995	acquire_cred_from	call site: 00000	/src/krb5/src/lib/gssapi/krb5/acquire_cred.c:1300
1042	1042	2 : View List ['krb5_cc_close', 'krb5_cc_destroy']	1103	1404	acquire_cred_context	call site: 00000	/src/krb5/src/lib/gssapi/krb5/acquire_cred.c:898
1037	1037	1 : View List ['krb5int_trace']	1037	1172	krb5_init_context_profile	call site: 00000	/src/krb5/src/lib/krb5/krb/init_ctx.c:277
990	990	4 : View List ['gss_release_oid', 'gssalloc_free.292', 'gssint_release_internal_name', 'free']	990	990	gss_release_name	call site: 00000	/src/krb5/src/lib/gssapi/mechglue/g_rel_name.c:49
833	833	1 : View List ['gss_inquire_cred']	2379	2926	get_negotiable_mechs	call site: 00000	/src/krb5/src/lib/gssapi/spnego/spnego_mech.c:3173

Runtime coverage analysis

Covered functions

243

Functions that are reachable but not covered

59

Reachable functions

117

Percentage of reachable functions covered

49.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_gss.c	1
lib/gssapi/mechglue/g_accept_sec_context.c	3
lib/gssapi/mechglue/g_glue.c	6
lib/gssapi/mechglue/../../../include/k5-input.h	1
lib/gssapi/generic/util_token.c	1
lib/gssapi/generic/../../../include/k5-der.h	2
lib/gssapi/generic/../../../include/k5-input.h	4
lib/gssapi/mechglue/g_initialize.c	20
util/support/threads.c	5
lib/gssapi/mechglue/../../../include/k5-thread.h	2
lib/gssapi/generic/oid_ops.c	9
util/support/plugins.c	7
util/support/errors.c	4
lib/gssapi/mechglue/g_rel_oid_set.c	1
lib/gssapi/generic/rel_oid_set.c	1
lib/gssapi/generic/../../../include/gssapi/gssapi_alloc.h	3
lib/gssapi/mechglue/g_mechattr.c	1
lib/gssapi/generic/util_errmap.c	5
lib/gssapi/generic/../../../include/k5-thread.h	2
lib/gssapi/generic/./errmap.h	9
lib/gssapi/mechglue/g_rel_buffer.c	1
lib/gssapi/mechglue/../../../include/gssapi/gssapi_alloc.h	1
lib/gssapi/mechglue/g_delete_sec_context.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
iakerb_gss_accept_sec_context	/src/krb5/src/lib/gssapi/krb5/iakerb.c	11	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	27	0	261	43	16	1232	0	7753	4623
spnego_gss_accept_sec_context	/src/krb5/src/lib/gssapi/spnego/spnego_mech.c	11	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	20	0	707	136	49	511	0	3610	928
iakerb_gss_init_sec_context	/src/krb5/src/lib/gssapi/krb5/iakerb.c	13	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'int', 'int', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	27	0	397	61	23	1227	0	7717	353
iakerb_gss_verify_mic_iov	/src/krb5/src/lib/gssapi/krb5/iakerb.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'int']	11	0	55	6	3	149	0	745	325
iakerb_gss_export_sec_context	/src/krb5/src/lib/gssapi/krb5/iakerb.c	3	['N/A', 'N/A', 'N/A']	25	0	66	9	4	407	0	2333	305
iakerb_gss_import_sec_context	/src/krb5/src/lib/gssapi/krb5/iakerb.c	3	['N/A', 'N/A', 'N/A']	19	0	100	10	5	418	0	2542	287
spnego_gss_init_sec_context	/src/krb5/src/lib/gssapi/spnego/spnego_mech.c	13	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'int', 'int', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	20	0	533	96	35	506	0	3528	184

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1693 / 3033

Cyclomatic complexity statically reachable by fuzzers

12030 / 19405

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity