High level conclusions

Fuzzers reach 55.21% code coverage.

Fuzzers reach 84.68% of cyclomatic complexity.

Fuzzers reach 69.71% of all functions.

Fuzzer oscore_decrypt_fuzzer is blocked:

The runtime code coverage of oscore_decrypt_fuzzer covers 23.30% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer network_message_fuzzer is blocked:

The runtime code coverage of network_message_fuzzer covers 26.66% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer async_fuzzer is blocked:

The runtime code coverage of async_fuzzer covers 24.65% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer proxy_fuzzer is blocked:

The runtime code coverage of proxy_fuzzer covers 22.41% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer persist_fuzzer is blocked:

The runtime code coverage of persist_fuzzer covers 23.29% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer block_check_fuzzer is blocked:

The runtime code coverage of block_check_fuzzer covers 23.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer cache_key_fuzzer is blocked:

The runtime code coverage of cache_key_fuzzer covers 14.44% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer observe_fuzzer is blocked:

The runtime code coverage of observe_fuzzer covers 24.87% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer block_fuzzer is blocked:

The runtime code coverage of block_fuzzer covers 27.80% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ws_frame_fuzzer is blocked:

The runtime code coverage of ws_frame_fuzzer covers 10.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dtls_define_fuzzer is blocked:

The runtime code coverage of dtls_define_fuzzer covers 23.80% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

702 / 1007

Cyclomatic complexity statically reachable by fuzzers

7955 / 9394

Runtime code coverage of functions

556 / 1007

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: dtls_define_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	25.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	45	75.0%
All colors	60	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	10	coap_dtls_define_issue	call site: 00010	print_timestamp

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

16

Reachable functions

21

Percentage of reachable functions covered

23.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/dtls_define_target.c	1
src/coap_debug.c	5
src/coap_dtls.c	3
src/coap_time.c	3

Fuzzer: get_asn1_tag_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	53.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	15	46.8%
All colors	32	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	9	coap_new_string	call site: 00009	coap_log_impl

Runtime coverage analysis

Covered functions

10

Functions that are reachable but not covered

15

Reachable functions

25

Percentage of reachable functions covered

40.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/get_asn1_tag_target.c	1
src/coap_asn1.c	4
src/coap_str.c	3
src/coap_mem.c	2
src/coap_debug.c	4
src/coap_time.c	3

Fuzzer: pdu_parse_ws_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	91	20.3%
gold	[1:9]	16	3.57%
yellow	[10:29]	12	2.67%
greenyellow	[30:49]	7	1.56%
lawngreen	50+	322	71.8%
All colors	448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	416	coap_pdu_encode_header	call site: 00416	coap_log_impl
8	251	coap_show_pdu	call site: 00251	coap_log_impl
7	194	coap_dtls_is_supported	call site: 00194	coap_log_impl
7	367	coap_show_pdu	call site: 00367	coap_log_impl
5	407	LLVMFuzzerTestOneInput	call site: 00407	coap_log_impl
4	53	coap_pdu_parse2	call site: 00053	coap_log_impl
4	103	coap_pdu_parse_opt	call site: 00103	coap_log_impl
4	108	coap_pdu_parse_opt	call site: 00108	coap_log_impl
4	206	coap_tls_is_supported	call site: 00206	coap_log_impl
4	216	coap_wss_is_supported	call site: 00216	coap_log_impl
3	31	coap_pdu_parse2	call site: 00031	coap_log_impl
3	175	coap_get_uri_path	call site: 00175	coap_new_string

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

18

Reachable functions

98

Percentage of reachable functions covered

81.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/pdu_parse_ws_target.c	1
src/coap_net.c	2
src/coap_time.c	4
src/coap_prng.c	2
src/coap_mem.c	4
src/coap_openssl.c	5
src/coap_pdu.c	18
src/coap_debug.c	13
src/coap_option.c	12
src/coap_encode.c	3
src/coap_uri.c	9
src/coap_str.c	3
src/coap_strm_posix.c	1
src/coap_ws.c	2
src/coap_block.c	1

Fuzzer: pdu_parse_tcp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	19.4%
gold	[1:9]	17	3.79%
yellow	[10:29]	10	2.23%
greenyellow	[30:49]	6	1.33%
lawngreen	50+	328	73.2%
All colors	448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	251	coap_show_pdu	call site: 00251	coap_log_impl
7	367	coap_show_pdu	call site: 00367	coap_log_impl
5	407	LLVMFuzzerTestOneInput	call site: 00407	coap_log_impl
4	103	coap_pdu_parse_opt	call site: 00103	coap_log_impl
4	108	coap_pdu_parse_opt	call site: 00108	coap_log_impl
4	194	coap_dtls_is_supported	call site: 00194	coap_log_impl
4	206	coap_tls_is_supported	call site: 00206	coap_log_impl
4	216	coap_wss_is_supported	call site: 00216	coap_log_impl
4	425	coap_pdu_encode_header	call site: 00425	coap_log_impl
3	31	coap_pdu_parse2	call site: 00031	coap_log_impl
3	53	coap_pdu_parse2	call site: 00053	coap_log_impl
3	57	coap_pdu_parse_header	call site: 00057	coap_log_impl

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

18

Reachable functions

98

Percentage of reachable functions covered

81.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/pdu_parse_tcp_target.c	1
src/coap_net.c	2
src/coap_time.c	4
src/coap_prng.c	2
src/coap_mem.c	4
src/coap_openssl.c	5
src/coap_pdu.c	18
src/coap_debug.c	13
src/coap_option.c	12
src/coap_encode.c	3
src/coap_uri.c	9
src/coap_str.c	3
src/coap_strm_posix.c	1
src/coap_ws.c	2
src/coap_block.c	1

Fuzzer: uri_extended_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	83	38.0%
gold	[1:9]	4	1.83%
yellow	[10:29]	3	1.37%
greenyellow	[30:49]	4	1.83%
lawngreen	50+	124	56.8%
All colors	218	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	186	coap_uri_into_optlist_abbrev	call site: 00186	coap_new_optlist
14	20	coap_split_uri_sub	call site: 00020	print_timestamp
12	91	coap_opt_parse	call site: 00091	coap_log_impl
6	136	LLVMFuzzerTestOneInput	call site: 00136	coap_path_into_optlist_abbrev
5	147	coap_new_optlist	call site: 00147	coap_insert_optlist
4	41	coap_dtls_is_supported	call site: 00041	coap_log_impl
4	53	coap_tls_is_supported	call site: 00053	coap_log_impl
4	63	coap_wss_is_supported	call site: 00063	coap_log_impl
4	120	coap_opt_setheader	call site: 00120	coap_log_impl
2	38	coap_dtls_is_supported	call site: 00038	coap_log_impl
2	46	coap_split_uri_sub	call site: 00046	coap_log_impl
2	50	coap_tls_is_supported	call site: 00050	coap_log_impl

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

25

Reachable functions

82

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/uri_extended_target.c	1
src/coap_net.c	2
src/coap_time.c	4
src/coap_prng.c	2
src/coap_mem.c	3
src/coap_openssl.c	5
src/coap_debug.c	7
src/coap_uri.c	26
src/coap_strm_posix.c	1
src/coap_ws.c	2
src/coap_option.c	7
src/coap_encode.c	1
src/coap_pdu.c	1
./include/coap3/coap_uri.h	1

Fuzzer: ws_frame_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4741	94.7%
gold	[1:9]	54	1.07%
yellow	[10:29]	11	0.21%
greenyellow	[30:49]	189	3.77%
lawngreen	50+	11	0.21%
All colors	5006	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1369	3386	coap_session_free	call site: 03386	coap_dtls_handle_timeout
1165	2211	coap_session_check_connect	call site: 02211	coap_session_release_lkd
639	1000	coap_socket_connect_udp	call site: 01000	coap_session_reestablished
387	536	coap_session_free	call site: 00536	coap_delete_proxy_subscriber
294	1820	coap_session_connected	call site: 01820	coap_handle_event_lkd
138	1679	coap_session_disconnected_lkd	call site: 01679	coap_delete_node_lkd
135	383	coap_handle_event_lkd	call site: 00383	coap_proxy_remove_association
69	99	coap_dtls_new_context	call site: 00099	coap_session_str
69	247	coap_dtls_free_context	call site: 00247	coap_new_endpoint_lkd
46	325	coap_socket_dgrm_close	call site: 00325	coap_netif_strm_listen
40	4839	coap_ws_rd_http_header_client	call site: 04839	coap_ws_build_key_hash
39	2163	coap_session_create_client	call site: 02163	coap_netif_strm_connect1

Runtime coverage analysis

Covered functions

92

Functions that are reachable but not covered

718

Reachable functions

804

Percentage of reachable functions covered

10.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/ws_frame_target.c	4
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	67
src/coap_debug.c	15
src/coap_io.c	10
src/coap_session.c	53
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	15
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	34
src/coap_cache.c	5
src/coap_block.c	51
src/coap_resource.c	20
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3
src/coap_event.c	1

Fuzzer: block_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4165	84.6%
gold	[1:9]	135	2.74%
yellow	[10:29]	76	1.54%
greenyellow	[30:49]	78	1.58%
lawngreen	50+	467	9.48%
All colors	4921	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
580	2263	coap_make_str_const	call site: 02263	coap_session_release_lkd
259	4506	coap_handle_dgram	call site: 04506	coap_handle_event_lkd
246	3746	coap_dispatch	call site: 03746	coap_oscore_decrypt_pdu
243	3398	coap_session_free	call site: 03398	coap_dtls_handle_timeout
240	1364	coap_send_internal	call site: 01364	coap_oscore_new_pdu_encrypted_lkd
168	1037	coap_pdu_encode_header	call site: 01037	coap_proxy_forward_request_lkd
157	709	coap_show_pdu	call site: 00709	coap_session_release_lkd
147	1979	coap_add_data_large_internal	call site: 01979	coap_add_data_large_request_lkd
139	4279	coap_handle_response_get_block	call site: 04279	coap_send_rst_lkd
126	3136	coap_handle_request_send_block	call site: 03136	coap_pdu_duplicate_lkd
103	4174	coap_find_lg_xmit	call site: 04174	coap_pdu_duplicate_lkd
75	3313	handle_request	call site: 03313	coap_resource_release_lkd

Runtime coverage analysis

Covered functions

235

Functions that are reachable but not covered

579

Reachable functions

802

Percentage of reachable functions covered

27.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/block_target.c	3
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	17
src/coap_io.c	10
src/coap_session.c	55
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	56
src/coap_resource.c	25
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3
src/coap_event.c	1
tests/oss-fuzz/coap_fuzz_helper.c	2

Fuzzer: observe_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4225	86.2%
gold	[1:9]	74	1.50%
yellow	[10:29]	74	1.50%
greenyellow	[30:49]	231	4.71%
lawngreen	50+	297	6.05%
All colors	4901	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
473	2263	coap_make_str_const	call site: 02263	coap_session_release_lkd
352	3746	coap_dispatch	call site: 03746	coap_oscore_decrypt_pdu
294	1832	coap_session_connected	call site: 01832	coap_handle_event_lkd
268	4150	coap_dispatch	call site: 04150	coap_send_ack_lkd
261	4506	coap_handle_dgram	call site: 04506	coap_handle_event_lkd
243	3398	coap_session_free	call site: 03398	coap_dtls_handle_timeout
241	1037	coap_pdu_encode_header	call site: 01037	coap_proxy_forward_request_lkd
240	1364	coap_send_internal	call site: 01364	coap_oscore_new_pdu_encrypted_lkd
153	3045	handle_request	call site: 03045	coap_handle_request_put_block
148	709	coap_show_pdu	call site: 00709	coap_option_next
94	2749	coap_cache_derive_key_w_ignore	call site: 02749	coap_cancel_observe_lkd
75	3313	handle_request	call site: 03313	coap_resource_release_lkd

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

598

Reachable functions

796

Percentage of reachable functions covered

24.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/observe_target.c	3
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	17
src/coap_io.c	10
src/coap_session.c	54
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	51
src/coap_resource.c	25
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3
src/coap_event.c	1
tests/oss-fuzz/coap_fuzz_helper.c	2

Fuzzer: cache_key_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4528	93.2%
gold	[1:9]	46	0.94%
yellow	[10:29]	30	0.61%
greenyellow	[30:49]	209	4.30%
lawngreen	50+	44	0.90%
All colors	4857	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
996	3687	coap_pdu_parse_opt	call site: 03687	coap_handle_event_lkd
639	2737	coap_cache_derive_key_w_ignore	call site: 02737	coap_cancel_observe_lkd
513	2211	coap_session_check_connect	call site: 02211	coap_session_release_lkd
312	611	coap_pdu_resize	call site: 00611	coap_session_release_lkd
311	1000	coap_socket_connect_udp	call site: 01000	coap_session_reestablished
294	1820	coap_session_connected	call site: 01820	coap_handle_event_lkd
289	1312	coap_pdu_parse_opt_base	call site: 01312	coap_oscore_new_pdu_encrypted_lkd
252	3386	coap_session_free	call site: 03386	coap_dtls_handle_timeout
145	1672	coap_delete_str_const	call site: 01672	coap_cancel_session_messages
87	426	coap_option_next	call site: 00426	coap_split_proxy_uri
69	99	coap_dtls_new_context	call site: 00099	coap_session_str
69	247	coap_dtls_free_context	call site: 00247	coap_new_endpoint_lkd

Runtime coverage analysis

Covered functions

117

Functions that are reachable but not covered

675

Reachable functions

789

Percentage of reachable functions covered

14.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/cache_key_target.c	1
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	15
src/coap_io.c	10
src/coap_session.c	54
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	11
src/coap_block.c	51
src/coap_resource.c	20
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3

Fuzzer: block_check_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4421	89.0%
gold	[1:9]	6	0.12%
yellow	[10:29]	376	7.57%
greenyellow	[30:49]	19	0.38%
lawngreen	50+	142	2.86%
All colors	4964	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1222	3520	coap_io_do_epoll_lkd	call site: 03520	coap_read_endpoint
664	2264	coap_make_str_const	call site: 02264	coap_session_release_lkd
289	1325	coap_pdu_parse_opt_base	call site: 01325	coap_oscore_new_pdu_encrypted_lkd
193	1013	coap_socket_connect_udp	call site: 01013	coap_session_reestablished
163	3026	coap_get_resource_from_uri_path_lkd	call site: 03026	coap_session_max_pdu_size_lkd
161	710	coap_show_pdu	call site: 00710	coap_session_release_lkd
131	3190	coap_add_block_b_data	call site: 03190	coap_send_internal
117	2010	coap_add_block	call site: 02010	coap_send_internal
87	1731	coap_add_option	call site: 01731	coap_send_internal
69	112	coap_dtls_new_context	call site: 00112	coap_session_str
66	458	coap_new_string	call site: 00458	coap_split_proxy_uri
63	3399	coap_session_free	call site: 03399	coap_dtls_handle_timeout

Runtime coverage analysis

Covered functions

187

Functions that are reachable but not covered

616

Reachable functions

800

Percentage of reachable functions covered

23.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/block_check_target.c	2
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	17
src/coap_io.c	10
src/coap_session.c	55
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	5
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	58
src/coap_resource.c	23
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3
src/coap_event.c	1

Fuzzer: persist_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4436	87.9%
gold	[1:9]	4	0.07%
yellow	[10:29]	3	0.05%
greenyellow	[30:49]	6	0.11%
lawngreen	50+	592	11.7%
All colors	5041	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
994	3702	coap_pdu_parse_opt	call site: 03702	coap_handle_event_lkd
473	2264	coap_make_str_const	call site: 02264	coap_session_release_lkd
294	1833	coap_session_connected	call site: 01833	coap_handle_event_lkd
252	3399	coap_session_free	call site: 03399	coap_dtls_handle_timeout
240	1365	coap_send_internal	call site: 01365	coap_oscore_new_pdu_encrypted_lkd
212	2750	coap_cache_derive_key_w_ignore	call site: 02750	coap_cancel_observe_lkd
179	3026	coap_get_resource_from_uri_path_lkd	call site: 03026	coap_session_max_pdu_size_lkd
168	1038	coap_pdu_encode_header	call site: 01038	coap_proxy_forward_request_lkd
148	710	coap_show_pdu	call site: 00710	coap_option_next
140	3249	coap_touch_observer	call site: 03249	coap_delete_observer_request
111	1213	coap_new_bin_const	call site: 01213	coap_send_internal
71	4697	coap_pdu_parse	call site: 04697	coap_handle_event_lkd

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

629

Reachable functions

820

Percentage of reachable functions covered

23.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/persist_target.c	5
src/coap_subscribe.c	15
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	15
src/coap_io.c	10
src/coap_session.c	54
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	51
src/coap_resource.c	29
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	13
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4

Fuzzer: oscore_conf_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	30	17.2%
gold	[1:9]	23	13.2%
yellow	[10:29]	8	4.59%
greenyellow	[30:49]	8	4.59%
lawngreen	50+	105	60.3%
All colors	174	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	41	coap_new_string	call site: 00041	coap_log_impl
4	94	coap_delete_bin_const	call site: 00094	coap_log_impl
4	126	coap_parse_oscore_rcp_conf_mem	call site: 00126	coap_log_impl
2	16	coap_cleanup	call site: 00016	ENGINE_finish
1	11	coap_dtls_startup	call site: 00011	OPENSSL_init_crypto
1	14	LLVMFuzzerTestOneInput	call site: 00014	coap_cleanup
1	20	coap_cleanup	call site: 00020	coap_free_type
1	148	coap_parse_oscore_conf_mem	call site: 00148	__assert_fail

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

22

Reachable functions

61

Percentage of reachable functions covered

63.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/oscore_conf_parse_target.c	1
src/coap_net.c	2
src/coap_time.c	4
src/coap_prng.c	2
src/coap_mem.c	3
src/coap_openssl.c	3
src/coap_debug.c	6
src/coap_uri.c	1
src/coap_oscore.c	10
src/coap_str.c	6
src/oscore/oscore_cose.c	4
src/oscore/oscore.c	1

Fuzzer: pdu_parse_udp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	89	19.8%
gold	[1:9]	17	3.79%
yellow	[10:29]	22	4.91%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	320	71.4%
All colors	448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	410	coap_pdu_encode_header	call site: 00410	coap_log_impl
8	251	coap_show_pdu	call site: 00251	coap_log_impl
7	367	coap_show_pdu	call site: 00367	coap_log_impl
4	56	coap_pdu_parse_header	call site: 00056	coap_log_impl
4	103	coap_pdu_parse_opt	call site: 00103	coap_log_impl
4	108	coap_pdu_parse_opt	call site: 00108	coap_log_impl
4	194	coap_dtls_is_supported	call site: 00194	coap_log_impl
4	206	coap_tls_is_supported	call site: 00206	coap_log_impl
4	216	coap_wss_is_supported	call site: 00216	coap_log_impl
3	31	coap_pdu_parse2	call site: 00031	coap_log_impl
3	175	coap_get_uri_path	call site: 00175	coap_new_string
2	50	coap_realloc_type	call site: 00050	coap_log_impl

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

18

Reachable functions

98

Percentage of reachable functions covered

81.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/pdu_parse_udp_target.c	1
src/coap_net.c	2
src/coap_time.c	4
src/coap_prng.c	2
src/coap_mem.c	4
src/coap_openssl.c	5
src/coap_pdu.c	18
src/coap_debug.c	13
src/coap_option.c	12
src/coap_encode.c	3
src/coap_uri.c	9
src/coap_str.c	3
src/coap_strm_posix.c	1
src/coap_ws.c	2
src/coap_block.c	1

Fuzzer: proxy_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4396	89.9%
gold	[1:9]	93	1.90%
yellow	[10:29]	91	1.86%
greenyellow	[30:49]	167	3.41%
lawngreen	50+	142	2.90%
All colors	4889	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1369	3399	coap_session_free	call site: 03399	coap_dtls_handle_timeout
410	2979	coap_free_resource	call site: 02979	coap_check_async
358	2370	coap_proxy_get_ongoing_session	call site: 02370	coap_new_client_session_oscore_pki3_lkd
265	1833	coap_session_connected	call site: 01833	coap_handle_event_lkd
211	1365	coap_send_internal	call site: 01365	coap_oscore_new_pdu_encrypted_lkd
157	710	coap_show_pdu	call site: 00710	coap_session_release_lkd
145	2224	coap_session_check_connect	call site: 02224	coap_session_release_lkd
135	2834	coap_proxy_forward_request_lkd	call site: 02834	coap_proxy_call_response_handler
83	1213	coap_new_bin_const	call site: 01213	coap_send_internal
69	112	coap_dtls_new_context	call site: 00112	coap_session_str
69	260	coap_dtls_free_context	call site: 00260	coap_new_endpoint_lkd
62	874	coap_free_resource	call site: 00874	coap_notify_observers

Runtime coverage analysis

Covered functions

185

Functions that are reachable but not covered

616

Reachable functions

794

Percentage of reachable functions covered

22.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/proxy_target.c	4
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	17
src/coap_io.c	10
src/coap_session.c	54
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	23
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	51
src/coap_resource.c	23
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3
src/coap_event.c	1

Fuzzer: split_uri_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	22	33.3%
gold	[1:9]	13	19.6%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	6.06%
lawngreen	50+	27	40.9%
All colors	66	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	28	coap_dtls_is_supported	call site: 00028	coap_log_impl
4	40	coap_tls_is_supported	call site: 00040	coap_log_impl
4	50	coap_wss_is_supported	call site: 00050	coap_log_impl
2	25	coap_dtls_is_supported	call site: 00025	coap_log_impl
2	33	coap_split_uri_sub	call site: 00033	coap_log_impl
2	37	coap_tls_is_supported	call site: 00037	coap_log_impl
2	46	coap_ws_is_supported	call site: 00046	coap_log_impl
1	6	coap_split_uri_sub	call site: 00006	vsnprintf
1	17	coap_log_impl	call site: 00017	snprintf

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

13

Reachable functions

28

Percentage of reachable functions covered

53.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/split_uri_target.c	1
src/coap_uri.c	2
src/coap_debug.c	4
src/coap_time.c	3
src/coap_openssl.c	2
src/coap_strm_posix.c	1
src/coap_ws.c	2

Fuzzer: async_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4320	87.2%
gold	[1:9]	94	1.89%
yellow	[10:29]	112	2.26%
greenyellow	[30:49]	294	5.93%
lawngreen	50+	130	2.62%
All colors	4950	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
580	2263	coap_make_str_const	call site: 02263	coap_session_release_lkd
321	3746	coap_dispatch	call site: 03746	coap_oscore_decrypt_pdu
294	1832	coap_session_connected	call site: 01832	coap_handle_event_lkd
268	4150	coap_dispatch	call site: 04150	coap_send_ack_lkd
261	4506	coap_handle_dgram	call site: 04506	coap_handle_event_lkd
243	3398	coap_session_free	call site: 03398	coap_dtls_handle_timeout
241	1037	coap_pdu_encode_header	call site: 01037	coap_proxy_forward_request_lkd
240	1364	coap_send_internal	call site: 01364	coap_oscore_new_pdu_encrypted_lkd
220	3044	handle_request	call site: 03044	coap_handle_request_put_block
157	709	coap_show_pdu	call site: 00709	coap_session_release_lkd
69	111	coap_dtls_new_context	call site: 00111	coap_session_str
69	259	coap_dtls_free_context	call site: 00259	coap_new_endpoint_lkd

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

608

Reachable functions

807

Percentage of reachable functions covered

24.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/async_target.c	3
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	17
src/coap_io.c	10
src/coap_session.c	55
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	51
src/coap_resource.c	24
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	15
src/coap_subscribe.c	3
src/coap_event.c	1
tests/oss-fuzz/coap_fuzz_helper.c	2

Fuzzer: network_message_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4163	84.5%
gold	[1:9]	38	0.77%
yellow	[10:29]	50	1.01%
greenyellow	[30:49]	46	0.93%
lawngreen	50+	628	12.7%
All colors	4925	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
404	2440	setup_pki_ssl	call site: 02440	coap_session_release_lkd
321	3747	coap_dispatch	call site: 03747	coap_oscore_decrypt_pdu
294	1833	coap_session_connected	call site: 01833	coap_handle_event_lkd
268	4151	coap_dispatch	call site: 04151	coap_send_ack_lkd
243	3399	coap_session_free	call site: 03399	coap_dtls_handle_timeout
241	3032	handle_request	call site: 03032	coap_session_max_pdu_size_lkd
213	1047	coap_pdu_encode_header	call site: 01047	coap_proxy_forward_request_lkd
211	2224	coap_session_check_connect	call site: 02224	coap_session_release_lkd
207	1369	coap_send_internal	call site: 01369	coap_oscore_new_pdu_encrypted_lkd
157	711	coap_show_pdu	call site: 00711	coap_session_release_lkd
144	4613	coap_epoll_ctl_mod	call site: 04613	coap_accept_endpoint
78	2906	coap_send_error_lkd	call site: 02906	coap_pdu_duplicate_lkd

Runtime coverage analysis

Covered functions

229

Functions that are reachable but not covered

594

Reachable functions

810

Percentage of reachable functions covered

26.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/network_message_target.c	7
src/coap_net.c	75
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	67
src/coap_debug.c	17
src/coap_address.c	16
src/coap_io.c	10
src/coap_session.c	54
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_str.c	10
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	51
src/coap_resource.c	20
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
src/coap_oscore.c	19
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3

Fuzzer: oscore_decrypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4458	89.8%
gold	[1:9]	104	2.09%
yellow	[10:29]	53	1.06%
greenyellow	[30:49]	267	5.38%
lawngreen	50+	80	1.61%
All colors	4962	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1023	2472	oscore_context_release_recipients	call site: 02472	coap_session_release_lkd
711	4163	coap_oscore_decrypt_pdu	call site: 04163	coap_delete_node_lkd
356	3505	coap_session_free	call site: 03505	coap_dtls_handle_timeout
256	1161	coap_pdu_encode_header	call site: 01161	coap_proxy_forward_request_lkd
249	1952	coap_session_connected	call site: 01952	coap_handle_event_lkd
226	833	coap_show_pdu	call site: 00833	coap_session_release_lkd
92	4069	coap_oscore_decrypt_pdu	call site: 04069	coap_handle_event_lkd
82	569	coap_option_filter_get	call site: 00569	coap_split_proxy_uri
74	1875	coap_send_internal	call site: 01875	coap_io_process_lkd
70	85	coap_delete_bin_const	call site: 00085	coap_parse_oscore_rcp_conf_mem
69	240	coap_dtls_new_context	call site: 00240	coap_session_str
69	388	coap_dtls_free_context	call site: 00388	coap_new_endpoint_lkd

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

612

Reachable functions

798

Percentage of reachable functions covered

23.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/oscore_decrypt_target.c	1
src/coap_net.c	61
src/coap_time.c	5
src/coap_prng.c	2
src/coap_mem.c	5
src/coap_openssl.c	65
src/coap_debug.c	17
src/coap_oscore.c	28
src/coap_str.c	10
src/coap_io.c	10
src/coap_session.c	54
src/coap_address.c	16
src/coap_netif.c	11
src/coap_strm_posix.c	6
src/coap_ws.c	2
src/coap_dgrm_posix.c	4
src/coap_io_posix.c	4
src/coap_proxy.c	22
src/coap_uri.c	20
src/coap_option.c	21
src/coap_encode.c	6
src/coap_pdu.c	35
src/coap_cache.c	5
src/coap_block.c	51
src/coap_resource.c	20
./include/coap3/coap_pdu_internal.h	1
./include/coap3/coap_resource_internal.h	1
./include/coap3/coap_uri.h	1
src/oscore/oscore_cose.c	19
src/oscore/oscore_context.c	27
src/oscore/oscore.c	8
src/oscore/oscore_cbor.c	11
./include/coap3/coap_block_internal.h	6
src/oscore/oscore_crypto.c	4
/usr/include/openssl/ssl.h	3
src/coap_dtls.c	4
/usr/include/openssl/x509v3.h	3
src/coap_async.c	4
src/coap_subscribe.c	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
hnd_get_wellknown_lkd	/src/libcoap/src/coap_net.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	133	0	304	50	16	687	0	6974	108
coap_netif_dgrm_write	/src/libcoap/src/coap_netif.c	3	['N/A', 'N/A', 'size_t']	8	0	155	30	9	62	0	317	71
coap_tls_engine_configure	/src/libcoap/src/coap_openssl.c	1	['N/A']	6	0	575	124	34	32	0	121	52
coap_op_resource_deleted	/src/libcoap/src/coap_subscribe.c	3	['N/A', 'N/A', 'N/A']	6	0	252	40	16	37	0	129	40
coap_session_set_type_server	/src/libcoap/src/coap_session.c	1	['N/A']	130	0	18	3	2	683	0	6902	36
coap_join_mcast_group_intf	/src/libcoap/src/coap_net.c	3	['N/A', 'N/A', 'N/A']	6	0	24	3	2	37	0	127	36

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

723 / 1007

Cyclomatic complexity statically reachable by fuzzers

8290 / 9394

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/oss-fuzz/dtls_define_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_dtls_define_issue']

tests/oss-fuzz/get_asn1_tag_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_new_string']

tests/oss-fuzz/pdu_parse_ws_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_pdu_encode_header', 'coap_show_pdu', 'coap_dtls_is_supported', 'LLVMFuzzerTestOneInput', 'coap_pdu_parse2', 'coap_pdu_parse_opt', 'coap_tls_is_supported', 'coap_wss_is_supported']

tests/oss-fuzz/pdu_parse_tcp_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_show_pdu', 'LLVMFuzzerTestOneInput', 'coap_pdu_parse_opt', 'coap_dtls_is_supported', 'coap_tls_is_supported', 'coap_wss_is_supported', 'coap_pdu_encode_header', 'coap_pdu_parse2']

tests/oss-fuzz/uri_extended_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_uri_into_optlist_abbrev', 'coap_split_uri_sub', 'coap_opt_parse', 'LLVMFuzzerTestOneInput', 'coap_new_optlist', 'coap_dtls_is_supported', 'coap_tls_is_supported', 'coap_wss_is_supported', 'coap_opt_setheader']

tests/oss-fuzz/ws_frame_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_session_free', 'coap_session_check_connect', 'coap_socket_connect_udp', 'coap_session_connected', 'coap_session_disconnected_lkd', 'coap_handle_event_lkd', 'coap_dtls_new_context', 'coap_dtls_free_context', 'coap_socket_dgrm_close']

tests/oss-fuzz/block_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_make_str_const', 'coap_handle_dgram', 'coap_dispatch', 'coap_session_free', 'coap_send_internal', 'coap_pdu_encode_header', 'coap_show_pdu', 'coap_add_data_large_internal', 'coap_handle_response_get_block', 'coap_handle_request_send_block']

tests/oss-fuzz/observe_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_make_str_const', 'coap_dispatch', 'coap_session_connected', 'coap_handle_dgram', 'coap_session_free', 'coap_pdu_encode_header', 'coap_send_internal', 'handle_request', 'coap_show_pdu']

tests/oss-fuzz/cache_key_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_pdu_parse_opt', 'coap_cache_derive_key_w_ignore', 'coap_session_check_connect', 'coap_pdu_resize', 'coap_socket_connect_udp', 'coap_session_connected', 'coap_pdu_parse_opt_base', 'coap_session_free', 'coap_delete_str_const', 'coap_option_next']

tests/oss-fuzz/block_check_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_io_do_epoll_lkd', 'coap_make_str_const', 'coap_pdu_parse_opt_base', 'coap_socket_connect_udp', 'coap_get_resource_from_uri_path_lkd', 'coap_show_pdu', 'coap_add_block_b_data', 'coap_add_block', 'coap_add_option', 'coap_dtls_new_context']

tests/oss-fuzz/persist_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_pdu_parse_opt', 'coap_make_str_const', 'coap_session_connected', 'coap_session_free', 'coap_send_internal', 'coap_cache_derive_key_w_ignore', 'coap_get_resource_from_uri_path_lkd', 'coap_pdu_encode_header', 'coap_show_pdu', 'coap_touch_observer']

tests/oss-fuzz/oscore_conf_parse_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_new_string', 'coap_delete_bin_const', 'coap_parse_oscore_rcp_conf_mem', 'coap_cleanup', 'coap_dtls_startup', 'LLVMFuzzerTestOneInput', 'coap_parse_oscore_conf_mem']

tests/oss-fuzz/pdu_parse_udp_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_pdu_encode_header', 'coap_show_pdu', 'coap_pdu_parse_header', 'coap_pdu_parse_opt', 'coap_dtls_is_supported', 'coap_tls_is_supported', 'coap_wss_is_supported', 'coap_pdu_parse2']

tests/oss-fuzz/proxy_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_session_free', 'coap_free_resource', 'coap_proxy_get_ongoing_session', 'coap_session_connected', 'coap_send_internal', 'coap_show_pdu', 'coap_session_check_connect', 'coap_proxy_forward_request_lkd', 'coap_new_bin_const', 'coap_dtls_new_context']

tests/oss-fuzz/split_uri_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_dtls_is_supported', 'coap_tls_is_supported', 'coap_wss_is_supported', 'coap_split_uri_sub', 'coap_ws_is_supported', 'coap_log_impl']

tests/oss-fuzz/async_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['coap_make_str_const', 'coap_dispatch', 'coap_session_connected', 'coap_handle_dgram', 'coap_session_free', 'coap_pdu_encode_header', 'coap_send_internal', 'handle_request', 'coap_show_pdu']

tests/oss-fuzz/network_message_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['setup_pki_ssl', 'coap_dispatch', 'coap_session_connected', 'coap_session_free', 'handle_request', 'coap_pdu_encode_header', 'coap_session_check_connect', 'coap_send_internal', 'coap_show_pdu']

tests/oss-fuzz/oscore_decrypt_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oscore_context_release_recipients', 'coap_oscore_decrypt_pdu', 'coap_session_free', 'coap_pdu_encode_header', 'coap_session_connected', 'coap_show_pdu', 'coap_option_filter_get', 'coap_send_internal', 'coap_delete_bin_const']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
coap_socket_connect_udp	153	56	36.60%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_new_context	69	37	53.62%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_cancel_session_messages	32	5	15.62%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_handle_event_lkd	71	25	35.21%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_session_connected	60	11	18.33%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_ws_rd_http_header_server	79	10	12.65%	['ws_frame_fuzzer']
coap_ws_rd_http_header_client	62	11	17.74%	['ws_frame_fuzzer']
coap_find_lg_xmit	57	10	17.54%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_find_lg_crcv	31	10	32.25%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_handle_request_send_block	259	28	10.81%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_handle_request_put_block	392	183	46.68%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_handle_response_send_block	267	11	4.119%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_handle_response_get_block	556	29	5.215%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
setup_block_b	35	18	51.42%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
update_received_blocks	49	15	30.61%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_debug_set_packet_loss	39	13	33.33%	['proxy_fuzzer', 'block_check_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer']
coap_debug_send_packet	42	23	54.76%	['proxy_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_debug_set_packet_fail	39	13	33.33%	['proxy_fuzzer', 'block_check_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer']
coap_socket_send	118	20	16.94%	['proxy_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_test_cid_tuple_change	31	4	12.90%	['proxy_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_send_internal	152	70	46.05%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_remove_from_queue	36	6	16.66%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_call_response_handler	43	18	41.86%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_dispatch	394	175	44.41%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_is_session_proxy	58	10	17.24%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_remove_from_queue_token	45	4	8.888%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
handle_request	495	267	53.93%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
handle_response	75	22	29.33%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_remove_option	78	11	14.10%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_delete_proxy_subscriber	39	5	12.82%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_add_resource_lkd	38	20	52.63%	['proxy_fuzzer', 'block_check_fuzzer', 'block_fuzzer', 'async_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_pdu_duplicate_lkd	75	31	41.33%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_add_observer	143	62	43.35%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_delete_observer_internal	40	17	42.5%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_add_data_blocked_response	101	51	50.49%	['block_check_fuzzer']
coap_cancel_observe_lkd	72	13	18.05%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_block_check_lg_crcv_timeouts	55	19	34.54%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_block_check_lg_srcv_timeouts	137	19	13.86%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_block_check_q_block1_xmit	47	13	27.65%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_block_check_q_block2_xmit	48	13	27.08%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_socket_bind_udp	75	29	38.66%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_io_prepare_io_lkd	341	77	22.58%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_client_delay_first	47	5	10.63%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_io_do_epoll_lkd	69	10	14.49%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_new_endpoint_lkd	97	34	35.05%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_persist_observe_add_lkd	197	30	15.22%	['persist_fuzzer']
get_coap_addr_info	55	16	29.09%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
update_coap_addr_port	39	8	20.51%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_send_lkd	290	32	11.03%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_proxy_log_entry	32	3	9.375%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_proxy_del_req	34	10	29.41%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_verify_proxy_scheme_supported	45	11	24.44%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_proxy_remove_association	40	14	35.0%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_proxy_forward_request_lkd	228	100	43.85%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_proxy_get_ongoing_session	162	67	41.35%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_proxy_get_session	71	39	54.92%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_get_uri_proxy_scheme_info	51	24	47.05%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_resource_proxy_uri_init2	37	16	43.24%	['proxy_fuzzer']
coap_print_addr	40	15	37.5%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_print_ip_addr	49	15	30.61%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'uri_extended_fuzzer', 'persist_fuzzer']
prepend_508_ip	90	35	38.88%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
handle_signaling	77	33	42.85%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_dtls_info_callback	62	22	35.48%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_dgram_ctrl	61	31	50.81%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
setup_pki_ssl	291	13	4.467%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_session_delay_pdu	37	17	45.94%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_socket_connect_tcp1	102	36	35.29%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
coap_socket_write	39	20	51.28%	['network_message_fuzzer']
coap_oscore_decrypt_pdu	677	163	24.07%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
oscore_validate_sender_seq	51	18	35.29%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
oscore_cbor_put_unsigned	47	10	21.27%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
oscore_find_context	105	30	28.57%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']
oscore_log_context	39	4	10.25%	['proxy_fuzzer', 'block_check_fuzzer', 'cache_key_fuzzer', 'block_fuzzer', 'network_message_fuzzer', 'async_fuzzer', 'ws_frame_fuzzer', 'oscore_decrypt_fuzzer', 'observe_fuzzer', 'persist_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libcoap/src/coap_address.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_resource.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/observe_target.c	['observe_fuzzer']	['observe_fuzzer']
/src/libcoap/src/oscore/oscore_context.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_async.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/uri_extended_target.c	['uri_extended_fuzzer']	['uri_extended_fuzzer']
/src/libcoap/src/coap_event.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'block_check_fuzzer', 'proxy_fuzzer', 'async_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'block_check_fuzzer', 'proxy_fuzzer', 'async_fuzzer']
/src/libcoap/src/oscore/oscore.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['oscore_conf_parse_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_subscribe.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_dtls.c	['dtls_define_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['dtls_define_fuzzer', 'network_message_fuzzer']
/src/libcoap/./include/coap3/coap_resource_internal.h	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	[]
/src/libcoap/tests/oss-fuzz/coap_fuzz_helper.c	['block_fuzzer', 'observe_fuzzer', 'async_fuzzer']	['block_fuzzer', 'observe_fuzzer', 'async_fuzzer']
/src/libcoap/tests/oss-fuzz/network_message_target.c	['network_message_fuzzer']	['network_message_fuzzer']
/src/libcoap/src/coap_mem.c	['get_asn1_tag_fuzzer', 'pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['get_asn1_tag_fuzzer', 'pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/block_check_target.c	['block_check_fuzzer']	['block_check_fuzzer']
/src/libcoap/src/coap_encode.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/dtls_define_target.c	['dtls_define_fuzzer']	['dtls_define_fuzzer']
/src/libcoap/src/oscore/oscore_cbor.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['oscore_decrypt_fuzzer']
/src/libcoap/src/coap_io.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['block_fuzzer', 'observe_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer']
/src/libcoap/src/coap_option.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/pdu_parse_tcp_target.c	['pdu_parse_tcp_fuzzer']	['pdu_parse_tcp_fuzzer']
/src/libcoap/src/coap_proxy.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_netif.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_prng.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_debug.c	['dtls_define_fuzzer', 'get_asn1_tag_fuzzer', 'pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['dtls_define_fuzzer', 'pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/oscore/oscore_cose.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['oscore_conf_parse_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/pdu_parse_ws_target.c	['pdu_parse_ws_fuzzer']	['pdu_parse_ws_fuzzer']
/src/libcoap/src/coap_cache.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer']
/src/libcoap/tests/oss-fuzz/cache_key_target.c	['cache_key_fuzzer']	['cache_key_fuzzer']
/src/libcoap/tests/oss-fuzz/split_uri_target.c	['split_uri_fuzzer']	['split_uri_fuzzer']
/src/libcoap/./include/coap3/coap_uri.h	['uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	[]
/src/libcoap/tests/oss-fuzz/async_target.c	['async_fuzzer']	['async_fuzzer']
/src/libcoap/src/coap_io_posix.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/oscore_conf_parse_target.c	['oscore_conf_parse_fuzzer']	['oscore_conf_parse_fuzzer']
/src/libcoap/tests/oss-fuzz/persist_target.c	['persist_fuzzer']	['persist_fuzzer']
/src/libcoap/./include/coap3/coap_address.h	[]	[]
/src/libcoap/tests/oss-fuzz/pdu_parse_udp_target.c	['pdu_parse_udp_fuzzer']	['pdu_parse_udp_fuzzer']
/src/libcoap/src/oscore/oscore_crypto.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['oscore_decrypt_fuzzer']
/src/libcoap/src/coap_openssl.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/usr/include/openssl/ssl.h	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	[]
/src/libcoap/src/coap_asn1.c	['get_asn1_tag_fuzzer']	['get_asn1_tag_fuzzer']
/src/libcoap/src/coap_ws.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'pdu_parse_udp_fuzzer', 'split_uri_fuzzer']
/src/libcoap/tests/oss-fuzz/proxy_target.c	['proxy_fuzzer']	['proxy_fuzzer']
/src/libcoap/src/coap_oscore.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/tests/oss-fuzz/block_target.c	['block_fuzzer']	['block_fuzzer']
/src/libcoap/src/coap_dgrm_posix.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_strm_posix.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'pdu_parse_udp_fuzzer', 'split_uri_fuzzer', 'network_message_fuzzer']
/src/libcoap/tests/oss-fuzz/oscore_decrypt_target.c	['oscore_decrypt_fuzzer']	['oscore_decrypt_fuzzer']
/src/libcoap/src/coap_uri.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_pdu.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_block.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'pdu_parse_udp_fuzzer', 'async_fuzzer', 'network_message_fuzzer']
/src/libcoap/src/coap_net.c	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/./include/coap3/coap_pdu_internal.h	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	[]
/src/libcoap/./include/coap3/coap_block_internal.h	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	[]
/src/libcoap/tests/oss-fuzz/get_asn1_tag_target.c	['get_asn1_tag_fuzzer']	['get_asn1_tag_fuzzer']
/src/libcoap/tests/oss-fuzz/ws_frame_target.c	['ws_frame_fuzzer']	['ws_frame_fuzzer']
/src/libcoap/src/coap_session.c	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_str.c	['get_asn1_tag_fuzzer', 'pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['get_asn1_tag_fuzzer', 'pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/src/libcoap/src/coap_time.c	['dtls_define_fuzzer', 'get_asn1_tag_fuzzer', 'pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	['pdu_parse_ws_fuzzer', 'pdu_parse_tcp_fuzzer', 'uri_extended_fuzzer', 'ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'oscore_conf_parse_fuzzer', 'pdu_parse_udp_fuzzer', 'proxy_fuzzer', 'split_uri_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']
/usr/include/openssl/x509v3.h	['ws_frame_fuzzer', 'block_fuzzer', 'observe_fuzzer', 'cache_key_fuzzer', 'block_check_fuzzer', 'persist_fuzzer', 'proxy_fuzzer', 'async_fuzzer', 'network_message_fuzzer', 'oscore_decrypt_fuzzer']	[]

Directories in report

Directory
/src/libcoap/src/oscore/
/src/libcoap/./include/coap3/
/src/libcoap/src/
/src/libcoap/tests/oss-fuzz/
/usr/include/openssl/