Fuzz introspector: fuzz_mhd2
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
310 310 7 :

['daemon_deinit_net', 'daemon_deinit_tls', 'daemon_deinit_auth_digest', 'daemon_deinit_large_buf', 'daemon_deinit_threading_and_conn', 'daemon_stop_threads', 'daemon_close_connections']

310 338 MHD_daemon_destroy call site: 00190 /src/mhd2/src/mhd2/daemon_start.c:3472
12 12 1 :

['mhd_panic']

55 93 MHD_response_destroy call site: 00116 /src/mhd2/src/mhd2/response_destroy.c:109
6 6 1 :

['clock_gettime']

10 10 mhd_mclock_init_once call site: 00149 /src/mhd2/src/mhd2/mhd_mono_clock.c:395
5 5 1 :

['mhd_daemon_get_wait_max']

5 5 MHD_daemon_get_info_dynamic_sz call site: 00188 /src/mhd2/src/mhd2/daemon_get_info.c:227
2 2 1 :

['pthread_mutex_lock']

16 35 MHD_response_add_header call site: 00068 /src/mhd2/src/mhd2/response_add_header.c:136
2 2 1 :

['close']

2 2 fuzz_response_config(FuzzedDataProvider&,MHD_Response*) call site: 00000 /src/fuzz_mhd2.cpp:164
2 2 1 :

['close']

2 2 dsettings_release call site: 00191 /src/mhd2/src/mhd2/daemon_start.c:113
0 0 None 43 43 MHD_response_destroy call site: 00117 /src/mhd2/src/mhd2/response_destroy.c:112
0 0 None 14 53 mhd_lib_init_global_if_needed call site: 00146 /src/mhd2/src/mhd2/mhd_lib_init.c:426
0 0 None 14 22 MHD_response_set_options call site: 00096 /src/mhd2/src/mhd2/response_set_options.c:59
0 0 None 14 14 mhd_lib_init_global_if_needed call site: 00146 /src/mhd2/src/mhd2/mhd_lib_init.c:428
0 0 None 4 4 MHD_daemon_create call site: 00142 /src/mhd2/src/mhd2/daemon_create.c:57

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fuzz_digest_auth_calc(FuzzedDataProvider&) [function] [call site] 00001
2 MHD_digest_get_hash_size [function] [call site] 00002
3 digest_get_hash_size [function] [call site] 00003
2 MHD_digest_auth_calc_userhash [function] [call site] 00004
3 get_base_digest_algo [function] [call site] 00005
3 digest_init_one_time [function] [call site] 00006
4 mhd_MD5_init [function] [call site] 00007
4 mhd_SHA256_init [function] [call site] 00008
4 mhd_SHA512_256_init [function] [call site] 00009
3 digest_get_size [function] [call site] 00010
3 strlen [call site] 00011
3 strlen [call site] 00012
3 calc_userhash [function] [call site] 00013
4 digest_update [function] [call site] 00014
5 mhd_MD5_update [function] [call site] 00015
6 md5_transform [function] [call site] 00016
6 md5_transform [function] [call site] 00017
5 mhd_SHA256_update [function] [call site] 00018
6 sha256_transform [function] [call site] 00019
6 sha256_transform [function] [call site] 00020
5 mhd_SHA512_256_update [function] [call site] 00021
6 sha512_256_transform [function] [call site] 00022
6 sha512_256_transform [function] [call site] 00023
4 digest_update_with_colon [function] [call site] 00024
5 digest_update [function] [call site] 00025
4 digest_update [function] [call site] 00026
4 digest_calc_hash [function] [call site] 00027
5 mhd_MD5_finish [function] [call site] 00028
6 md5_transform [function] [call site] 00029
6 mhd_PUT_64BIT_LE_UNALIGN [function] [call site] 00030
6 md5_transform [function] [call site] 00031
5 mhd_SHA256_finish [function] [call site] 00032
6 sha256_transform [function] [call site] 00033
6 mhd_PUT_64BIT_BE_UNALIGN [function] [call site] 00034
6 sha256_transform [function] [call site] 00035
5 mhd_SHA512_256_finish [function] [call site] 00036
6 sha512_256_transform [function] [call site] 00037
6 sha512_256_transform [function] [call site] 00038
2 MHD_digest_auth_calc_userhash_hex [function] [call site] 00039
3 digest_get_hash_size [function] [call site] 00040
3 MHD_digest_auth_calc_userhash [function] [call site] 00041
3 mhd_bin_to_hex_z [function] [call site] 00042
4 mhd_bin_to_hex [function] [call site] 00043
5 uint8totwoxdigits [function] [call site] 00044
2 MHD_digest_auth_calc_userdigest [function] [call site] 00045
3 get_base_digest_algo [function] [call site] 00046
3 digest_init_one_time [function] [call site] 00047
3 digest_get_size [function] [call site] 00048
3 strlen [call site] 00049
3 strlen [call site] 00050
3 calc_userdigest [function] [call site] 00051
4 digest_update [function] [call site] 00052
4 digest_update_with_colon [function] [call site] 00053
4 digest_update [function] [call site] 00054
4 digest_update_with_colon [function] [call site] 00055
4 digest_update_str [function] [call site] 00056
5 strlen [call site] 00057
5 digest_update [function] [call site] 00058
4 digest_calc_hash [function] [call site] 00059
1 fuzz_response_creation(FuzzedDataProvider&) [function] [call site] 00060
2 MHD_response_from_buffer [function] [call site] 00061
3 response_create_basic [function] [call site] 00062
4 calloc [call site] 00063
4 calloc [call site] 00064
2 MHD_response_from_buffer [function] [call site] 00065
2 MHD_response_from_buffer [function] [call site] 00066
1 fuzz_response_config(FuzzedDataProvider&, MHD_Response*) [function] [call site] 00067
2 MHD_response_add_header [function] [call site] 00068
3 pthread_mutex_lock [call site] 00069
3 response_add_header_int [function] [call site] 00070
4 strlen [call site] 00071
4 strlen [call site] 00072
4 memchr [call site] 00073
4 memchr [call site] 00074
4 memchr [call site] 00075
4 memchr [call site] 00076
4 memchr [call site] 00077
4 memchr [call site] 00078
4 memchr [call site] 00079
4 response_add_header_no_check [function] [call site] 00080
3 pthread_mutex_unlock [call site] 00081
3 mhd_panic [function] [call site] 00082
4 fprintf [call site] 00083
4 fprintf [call site] 00084
4 fprintf [call site] 00085
4 abort [call site] 00086
2 MHD_response_add_header [function] [call site] 00087
2 MHD_response_add_header [function] [call site] 00088
2 MHD_response_add_header [function] [call site] 00089
2 MHD_response_add_predef_header [function] [call site] 00090
2 ToMhdBool(bool) [function] [call site] 00091
2 MHD_R_OPTION_REUSABLE(MHD_Bool) [function] [call site] 00092
2 MHD_response_set_options [function] [call site] 00093
3 pthread_mutex_lock [call site] 00094
3 pthread_mutex_unlock [call site] 00095
3 mhd_panic [function] [call site] 00096
3 response_make_reusable [function] [call site] 00097
4 pthread_mutex_init [call site] 00098
4 pthread_mutex_destroy [call site] 00099
3 pthread_mutex_unlock [call site] 00100
3 mhd_panic [function] [call site] 00101
2 ToMhdBool(bool) [function] [call site] 00102
2 MHD_R_OPTION_HEAD_ONLY_RESPONSE(MHD_Bool) [function] [call site] 00103
2 MHD_response_set_options [function] [call site] 00104
2 ToMhdBool(bool) [function] [call site] 00105
2 MHD_R_OPTION_CHUNKED_ENC(MHD_Bool) [function] [call site] 00106
2 MHD_response_set_options [function] [call site] 00107
2 ToMhdBool(bool) [function] [call site] 00108
2 MHD_R_OPTION_CONN_CLOSE(MHD_Bool) [function] [call site] 00109
2 MHD_response_set_options [function] [call site] 00110
2 mkstemp [call site] 00111
2 write [call site] 00112
2 lseek [call site] 00113
2 MHD_response_from_fd [function] [call site] 00114
3 response_create_basic [function] [call site] 00115
2 MHD_response_destroy [function] [call site] 00116
3 mhd_panic [function] [call site] 00117
3 response_full_deinit [function] [call site] 00118
4 mhd_response_remove_auth_digest_headers [function] [call site] 00119
4 mhd_response_remove_all_headers [function] [call site] 00120
4 mhd_response_deinit_reusable [function] [call site] 00121
5 pthread_mutex_destroy [call site] 00122
5 mhd_panic [function] [call site] 00123
4 mhd_response_deinit_content_data [function] [call site] 00124
5 close [call site] 00125
3 mhd_response_dec_use_count [function] [call site] 00126
4 mhd_panic [function] [call site] 00127
4 response_full_deinit [function] [call site] 00128
2 close [call site] 00129
2 close [call site] 00130
2 unlink [call site] 00131
2 pipe [call site] 00132
2 write [call site] 00133
2 close [call site] 00134
2 MHD_response_from_pipe [function] [call site] 00135
3 response_create_basic [function] [call site] 00136
2 MHD_response_destroy [function] [call site] 00137
2 close [call site] 00138
1 MHD_response_destroy [function] [call site] 00139
1 fuzz_daemon_lifecycle(FuzzedDataProvider&) [function] [call site] 00140
2 MHD_daemon_create [function] [call site] 00141
3 mhd_lib_init_global_if_needed [function] [call site] 00142
4 mhd_lib_global_lazy_init [function] [call site] 00143
5 mhd_panic_init_default [function] [call site] 00144
5 pthread_mutex_init [call site] 00145
4 pthread_mutex_lock [call site] 00146
4 mhd_lib_global_full_init_once [function] [call site] 00147
5 mhd_mclock_init_once [function] [call site] 00148
6 clock_gettime [call site] 00149
6 clock_gettime [call site] 00150
6 clock_gettime [call site] 00151
6 clock_gettime [call site] 00152
6 timespec_get [call site] 00153
6 time [call site] 00154
5 mhd_send_init_once [function] [call site] 00155
6 iov_max_init_ [function] [call site] 00156
7 sysconf [call site] 00157
5 mhd_tls_gnu_global_init [function] [call site] 00158
6 gnutls_check_version [call site] 00159
6 gnutls_global_init [call site] 00160
4 mhd_lib_global_full_re_init [function] [call site] 00161
5 mhd_tls_gnu_global_init [function] [call site] 00162
4 pthread_mutex_unlock [call site] 00163
4 mhd_panic [function] [call site] 00164
3 calloc [call site] 00165
2 daemon_configuration(FuzzedDataProvider&, MHD_Daemon*) [function] [call site] 00166
3 MHD_D_OPTION_POLL_SYSCALL(MHD_SockPollSyscall) [function] [call site] 00167
3 MHD_daemon_set_options [function] [call site] 00168
4 strlen [call site] 00169
4 strlen [call site] 00170
4 strlen [call site] 00171
3 MHD_D_OPTION_BIND_PORT(MHD_AddressFamily, unsigned short) [function] [call site] 00172
3 MHD_daemon_set_options [function] [call site] 00173
3 MHD_D_OPTION_DEFAULT_TIMEOUT(unsigned int) [function] [call site] 00174
3 MHD_daemon_set_options [function] [call site] 00175
3 MHD_D_OPTION_CONN_MEMORY_LIMIT(unsigned long) [function] [call site] 00176
3 MHD_daemon_set_options [function] [call site] 00177
3 MHD_D_OPTION_LOG_CALLBACK(void (*)(void*, MHD_StatusCode, char const*, __va_list_tag*), void*) [function] [call site] 00178
3 dummy_log(void*, MHD_StatusCode, char const*, __va_list_tag*) [function] [call site] 00179
3 MHD_daemon_set_options [function] [call site] 00180
3 MHD_D_OPTION_RANDOM_ENTROPY(unsigned long, void*) [function] [call site] 00181
3 MHD_daemon_set_options [function] [call site] 00182
3 ToMhdBool(bool) [function] [call site] 00183
3 MHD_D_OPTION_REREGISTER_ALL(MHD_Bool) [function] [call site] 00184
3 MHD_daemon_set_options [function] [call site] 00185
2 MHD_daemon_get_info_fixed_sz [function] [call site] 00186
2 daemon_configuration(FuzzedDataProvider&, MHD_Daemon*) [function] [call site] 00187
2 MHD_daemon_get_info_dynamic_sz [function] [call site] 00188
3 mhd_daemon_get_wait_max [function] [call site] 00189
2 MHD_daemon_destroy [function] [call site] 00190
3 dsettings_release [function] [call site] 00191
4 close [call site] 00192
3 daemon_stop_threads [function] [call site] 00193
4 stop_individual_daemon_thread [function] [call site] 00194
5 mhd_daemon_trigger_itc [function] [call site] 00195
6 write [call site] 00196
6 __errno_location [call site] 00197
6 mhd_logger [function] [call site] 00198
5 pthread_join [call site] 00199
5 mhd_logger [function] [call site] 00200
4 stop_worker_pool_threads [function] [call site] 00201
5 mhd_daemon_trigger_itc [function] [call site] 00202
5 pthread_join [call site] 00203
5 mhd_logger [function] [call site] 00204
3 daemon_close_connections [function] [call site] 00205
4 mhd_daemon_close_all_conns [function] [call site] 00206
5 mhd_upgraded_deinit [function] [call site] 00207
6 pthread_mutex_destroy [call site] 00208
6 mhd_panic [function] [call site] 00209
5 mhd_conn_start_closing [function] [call site] 00210
6 mhd_socket_set_hard_close [function] [call site] 00211
7 setsockopt [call site] 00212
6 mhd_tls_gnu_conn_shutdown [function] [call site] 00213
7 gnutls_bye [call site] 00214
7 gnutls_record_get_direction [call site] 00215
6 mhd_socket_shut_wr [function] [call site] 00216
7 shutdown [call site] 00217
6 mhd_logger [function] [call site] 00218
6 mhd_conn_remove_from_timeout_lists [function] [call site] 00219
5 mhd_conn_pre_clean [function] [call site] 00220
6 mhd_conn_pre_clean_part1 [function] [call site] 00221
7 mhd_conn_mark_unready [function] [call site] 00222
7 mhd_stream_call_dcc_cleanup_if_needed [function] [call site] 00223
7 mhd_daemon_free_lbuf [function] [call site] 00224
8 mhd_daemon_reclaim_lbuf [function] [call site] 00225
9 mhd_daemon_get_master_daemon [function] [call site] 00226
9 pthread_mutex_lock [call site] 00227
9 mhd_panic [function] [call site] 00228
9 pthread_mutex_unlock [call site] 00229
9 mhd_panic [function] [call site] 00230
7 mhd_log_extr_event_dereg_failed [function] [call site] 00231
8 mhd_logger [function] [call site] 00232
7 epoll_ctl [call site] 00233
7 mhd_logger [function] [call site] 00234
6 mhd_response_dec_use_count [function] [call site] 00235
6 mhd_pool_destroy [function] [call site] 00236
7 munmap [call site] 00237
5 mhd_conn_remove_from_daemon [function] [call site] 00238
5 mhd_conn_close_final [function] [call site] 00239
6 mhd_tls_gnu_conn_deinit [function] [call site] 00240
7 gnutls_deinit [call site] 00241
6 close [call site] 00242
5 mhd_logger [function] [call site] 00243
3 daemon_deinit_threading_and_conn [function] [call site] 00244
4 deinit_individual_thread_data_events_conns [function] [call site] 00245
5 deinit_individual_conns [function] [call site] 00246
6 pthread_mutex_destroy [call site] 00247
6 mhd_panic [function] [call site] 00248
5 deinit_daemon_fds_monitoring [function] [call site] 00249
5 deinit_itc [function] [call site] 00250
6 close [call site] 00251
6 __errno_location [call site] 00252
5 deallocate_events [function] [call site] 00253
4 deinit_workers_pool [function] [call site] 00254
5 deinit_individual_thread_data_events_conns [function] [call site] 00255
5 deinit_epoll [function] [call site] 00256
6 close [call site] 00257
3 daemon_deinit_large_buf [function] [call site] 00258
4 pthread_mutex_destroy [call site] 00259
4 mhd_panic [function] [call site] 00260
3 daemon_deinit_tls [function] [call site] 00261
4 mhd_tls_gnu_daemon_deinit [function] [call site] 00262
5 daemon_deinit_priorities_cache [function] [call site] 00263
6 gnutls_priority_deinit [call site] 00264
5 daemon_deinit_credentials [function] [call site] 00265
6 gnutls_certificate_free_credentials [call site] 00266
6 daemon_deinit_dh_data [function] [call site] 00267
3 daemon_deinit_auth_digest [function] [call site] 00268
4 pthread_mutex_destroy [call site] 00269
4 mhd_panic [function] [call site] 00270
3 daemon_deinit_net [function] [call site] 00271
4 deinit_epoll [function] [call site] 00272
4 close [call site] 00273
3 mhd_lib_deinit_global_if_needed [function] [call site] 00274
4 pthread_mutex_lock [call site] 00275
4 mhd_panic [function] [call site] 00276
4 mhd_lib_global_full_deinit [function] [call site] 00277
5 mhd_tls_gnu_global_deinit [function] [call site] 00278
6 gnutls_global_deinit [call site] 00279
4 pthread_mutex_unlock [call site] 00280
4 mhd_panic [function] [call site] 00281