Fuzz introspector: ssh_sshsig_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
21 21 4 :

['ssh_threads_finalize', 'ssh_dh_finalize', 'ssh_socket_cleanup', 'ssh_crypto_finalize']

21 33 _ssh_finalize call site: 00000 /src/libssh/src/init.c:165
10 10 1 :

['ssh_dh_finalize']

10 10 ssh_dh_init call site: 00000 /src/libssh/src/dh.c:260
6 6 1 :

['buffer_shift']

6 19 ssh_buffer_add_data call site: 00056 /src/libssh/src/buffer.c:318
6 6 1 :

['buffer_shift']

6 19 ssh_buffer_allocate_size call site: 00042 /src/libssh/src/buffer.c:347
4 39 3 :

['OpenSSL_version', '_ssh_log', 'OpenSSL_version_num']

4 39 ssh_crypto_init call site: 00000 /src/libssh/src/libcrypto.c:1381
2 2 1 :

['exit']

2 2 ssh_mutex_lock call site: 00000 /src/libssh/src/threads/pthread.c:111
2 2 1 :

['exit']

2 2 ssh_mutex_unlock call site: 00000 /src/libssh/src/threads/pthread.c:126
0 10 1 :

['ssh_buffer_free']

0 10 base64_to_bin call site: 00060 /src/libssh/src/base64.c:125
0 10 1 :

['ssh_buffer_free']

0 10 base64_to_bin call site: 00062 /src/libssh/src/base64.c:144
0 10 1 :

['ssh_buffer_free']

0 10 base64_to_bin call site: 00064 /src/libssh/src/base64.c:162
0 0 None 21 27 _ssh_finalize call site: 00000 /src/libssh/src/init.c:162
0 0 None 10 10 ssh_dh_init call site: 00000 /src/libssh/src/dh.c:239

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 strncpy [call site] 00001
1 sshsig_verify [function] [call site] 00002
2 _ssh_log [function] [call site] 00003
3 ssh_get_log_level [function] [call site] 00004
3 ssh_vlog [function] [call site] 00005
4 vsnprintf [call site] 00006
4 ssh_log_function [function] [call site] 00007
5 ssh_get_log_callback [function] [call site] 00008
5 ssh_log_custom [function] [call site] 00009
6 snprintf [call site] 00010
6 ssh_get_log_userdata [function] [call site] 00011
5 ssh_log_stderr [function] [call site] 00012
6 current_timestring [function] [call site] 00013
7 gettimeofday [call site] 00014
7 localtime_r [call site] 00015
7 strftime [call site] 00016
7 snprintf [call site] 00017
7 strftime [call site] 00018
7 snprintf [call site] 00019
6 fprintf [call site] 00020
6 fprintf [call site] 00021
6 fprintf [call site] 00022
2 strlen [call site] 00023
2 sshsig_dearmor [function] [call site] 00025
3 strncmp [call site] 00027
3 __ctype_b_loc [call site] 00029
3 strstr [call site] 00030
3 __ctype_b_loc [call site] 00032
3 calloc [call site] 00033
3 __ctype_b_loc [call site] 00035
3 base64_to_bin [function] [call site] 00036
4 strdup [call site] 00037
4 get_equals [function] [call site] 00038
5 strchr [call site] 00039
4 ssh_buffer_new [function] [call site] 00040
5 calloc [call site] 00041
5 ssh_buffer_allocate_size [function] [call site] 00042
6 buffer_shift [function] [call site] 00043
7 explicit_bzero [call site] 00044
6 realloc_buffer [function] [call site] 00045
7 explicit_bzero [call site] 00046
7 realloc [call site] 00047
4 ssh_buffer_set_secure [function] [call site] 00048
4 strlen [call site] 00049
4 _base64_to_bin [function] [call site] 00050
5 to_block4 [function] [call site] 00051
6 strchr [call site] 00052
6 strchr [call site] 00053
6 strchr [call site] 00054
6 strchr [call site] 00055
4 ssh_buffer_add_data [function] [call site] 00056
5 buffer_shift [function] [call site] 00057
5 realloc_buffer [function] [call site] 00058
4 _base64_to_bin [function] [call site] 00059
4 ssh_buffer_add_data [function] [call site] 00060
4 _base64_to_bin [function] [call site] 00061
4 ssh_buffer_add_data [function] [call site] 00062
4 _base64_to_bin [function] [call site] 00063
4 ssh_buffer_add_data [function] [call site] 00064
4 ssh_buffer_free [function] [call site] 00065
5 explicit_bzero [call site] 00066
5 explicit_bzero [call site] 00067
2 ssh_buffer_get_len [function] [call site] 00070
2 ssh_buffer_get [function] [call site] 00071
2 memcmp [call site] 00072
2 ssh_buffer_free [function] [call site] 00074
2 ssh_buffer_pass_bytes [function] [call site] 00075
2 _ssh_buffer_unpack [function] [call site] 00076
3 ssh_buffer_unpack_va [function] [call site] 00077
4 ssh_buffer_get_len [function] [call site] 00078
4 ssh_buffer_get_u8 [function] [call site] 00079
5 ssh_buffer_get_data [function] [call site] 00080
6 ssh_buffer_validate_length [function] [call site] 00081
4 ssh_buffer_get_data [function] [call site] 00082
4 ntohs [call site] 00083
4 ssh_buffer_get_u32 [function] [call site] 00084
5 ssh_buffer_get_data [function] [call site] 00085
4 ntohl [call site] 00086
4 ssh_buffer_get_u64 [function] [call site] 00087
5 ssh_buffer_get_data [function] [call site] 00088
4 ntohl [call site] 00089
4 ssh_buffer_get_ssh_string [function] [call site] 00090
5 ssh_buffer_get_u32 [function] [call site] 00091
5 ntohl [call site] 00092
5 ssh_buffer_validate_length [function] [call site] 00093
5 ssh_string_new [function] [call site] 00094
6 __errno_location [call site] 00095
6 htonl [call site] 00096
5 ssh_string_data [function] [call site] 00097
5 ssh_buffer_get_data [function] [call site] 00098
4 ssh_make_string_bn [function] [call site] 00099
5 ssh_string_len [function] [call site] 00100
6 ntohl [call site] 00101
5 BN_new [call site] 00102
5 BN_bin2bn [call site] 00103
4 ssh_string_burn [function] [call site] 00104
5 ssh_string_len [function] [call site] 00105
5 explicit_bzero [call site] 00106
4 ssh_string_free [function] [call site] 00107
4 ssh_buffer_get_ssh_string [function] [call site] 00108
4 ssh_buffer_get_u32 [function] [call site] 00109
4 ntohl [call site] 00110
4 ssh_buffer_validate_length [function] [call site] 00111
4 ssh_buffer_get_data [function] [call site] 00112
4 ssh_buffer_validate_length [function] [call site] 00113
4 ssh_buffer_get_data [function] [call site] 00114
4 abort [call site] 00116
4 explicit_bzero [call site] 00117
4 explicit_bzero [call site] 00118
4 explicit_bzero [call site] 00119
4 explicit_bzero [call site] 00120
4 BN_clear_free [call site] 00121
4 ssh_string_burn [function] [call site] 00122
4 strlen [call site] 00123
4 explicit_bzero [call site] 00124
4 explicit_bzero [call site] 00125
2 ssh_buffer_free [function] [call site] 00127
2 ssh_pki_import_pubkey_blob [function] [call site] 00129
3 ssh_buffer_new [function] [call site] 00130
3 ssh_string_data [function] [call site] 00132
3 ssh_string_len [function] [call site] 00133
3 ssh_buffer_add_data [function] [call site] 00134
3 ssh_buffer_get_ssh_string [function] [call site] 00136
3 ssh_string_get_char [function] [call site] 00138
4 ssh_string_len [function] [call site] 00139
3 ssh_key_type_from_name [function] [call site] 00140
4 strcmp [call site] 00141
4 strcmp [call site] 00142
4 strcmp [call site] 00143
4 strcmp [call site] 00144
4 strcmp [call site] 00145
4 strcmp [call site] 00146
4 strcmp [call site] 00147
4 strcmp [call site] 00148
4 strcmp [call site] 00149
4 strcmp [call site] 00150
4 strcmp [call site] 00151
4 strcmp [call site] 00152
4 strcmp [call site] 00153
4 strcmp [call site] 00154
4 strcmp [call site] 00155
4 strcmp [call site] 00156
4 strcmp [call site] 00157
3 ssh_string_free [function] [call site] 00159
3 pki_import_cert_buffer [function] [call site] 00160
4 ssh_buffer_new [function] [call site] 00161
4 ssh_key_type_to_char [function] [call site] 00162
4 ssh_string_from_char [function] [call site] 00163
5 __errno_location [call site] 00164
5 strlen [call site] 00165
5 ssh_string_new [function] [call site] 00166
4 ssh_buffer_add_ssh_string [function] [call site] 00167
5 ssh_string_len [function] [call site] 00168
5 ssh_buffer_add_data [function] [call site] 00169
4 ssh_string_free [function] [call site] 00170
4 ssh_buffer_add_buffer [function] [call site] 00171
5 ssh_buffer_get [function] [call site] 00172
5 ssh_buffer_get_len [function] [call site] 00173
5 ssh_buffer_add_data [function] [call site] 00174
4 ssh_buffer_get_ssh_string [function] [call site] 00175
4 ssh_string_free [function] [call site] 00176
4 pki_import_pubkey_buffer [function] [call site] 00177
5 ssh_key_new [function] [call site] 00178
5 ssh_key_type_to_char [function] [call site] 00179
5 _ssh_buffer_unpack [function] [call site] 00180
5 pki_pubkey_build_rsa [function] [call site] 00182
6 RSA_new [call site] 00183
6 ssh_make_string_bn [function] [call site] 00184
6 ssh_make_string_bn [function] [call site] 00185
6 RSA_set0_key [call site] 00186
6 EVP_PKEY_new [call site] 00187
6 EVP_PKEY_assign [call site] 00188
6 EVP_PKEY_free [call site] 00189
6 RSA_free [call site] 00190
5 ssh_string_burn [function] [call site] 00191
5 ssh_string_free [function] [call site] 00192
5 ssh_string_burn [function] [call site] 00193
5 ssh_string_free [function] [call site] 00194
5 _ssh_buffer_unpack [function] [call site] 00196
5 ssh_string_get_char [function] [call site] 00198
5 pki_key_ecdsa_nid_from_name [function] [call site] 00199
6 strcmp [call site] 00200
6 strcmp [call site] 00201
6 strcmp [call site] 00202
5 ssh_string_free [function] [call site] 00203
5 ssh_string_burn [function] [call site] 00204
5 ssh_string_free [function] [call site] 00205
5 pki_pubkey_build_ecdsa [function] [call site] 00206
6 EC_KEY_new_by_curve_name [call site] 00207
6 EC_KEY_get0_group [call site] 00208
6 EC_POINT_new [call site] 00209
6 EC_KEY_free [call site] 00210
6 ssh_string_data [function] [call site] 00211
6 ssh_string_len [function] [call site] 00212
6 EC_POINT_oct2point [call site] 00213
6 EC_KEY_free [call site] 00214
6 EC_POINT_free [call site] 00215
6 EC_KEY_set_public_key [call site] 00216
6 EC_POINT_free [call site] 00217
6 EC_KEY_free [call site] 00218
6 EVP_PKEY_new [call site] 00219
6 EC_KEY_free [call site] 00220
6 EVP_PKEY_assign [call site] 00221
6 EC_KEY_free [call site] 00222
5 ssh_string_burn [function] [call site] 00223
5 ssh_string_free [function] [call site] 00224
5 ssh_buffer_get_ssh_string [function] [call site] 00226
5 ssh_key_type_to_char [function] [call site] 00228
5 ssh_buffer_get_ssh_string [function] [call site] 00229
5 ssh_string_len [function] [call site] 00230
5 ssh_string_burn [function] [call site] 00232
5 ssh_string_free [function] [call site] 00233
5 pki_pubkey_build_ed25519 [function] [call site] 00234
6 ssh_string_len [function] [call site] 00235
6 FIPS_mode [call site] 00237
6 ssh_string_data [function] [call site] 00239
6 ssh_string_data [function] [call site] 00240
6 EVP_PKEY_new_raw_public_key [call site] 00241
6 ERR_get_error [call site] 00242
6 ERR_error_string [call site] 00243
5 ssh_string_burn [function] [call site] 00245
5 ssh_string_free [function] [call site] 00246
5 ssh_buffer_get_ssh_string [function] [call site] 00248
5 ssh_key_free [function] [call site] 00251
6 ssh_key_clean [function] [call site] 00252
7 pki_key_clean [function] [call site] 00253
8 EVP_PKEY_free [call site] 00254
7 ssh_buffer_free [function] [call site] 00255
7 ssh_string_burn [function] [call site] 00256
7 ssh_string_free [function] [call site] 00257
7 ssh_string_burn [function] [call site] 00258
7 ssh_string_free [function] [call site] 00259
7 ssh_string_burn [function] [call site] 00260
7 ssh_string_free [function] [call site] 00261
4 pki_import_pubkey_buffer [function] [call site] 00262
4 pki_import_pubkey_buffer [function] [call site] 00263
4 pki_import_pubkey_buffer [function] [call site] 00264
4 pki_import_pubkey_buffer [function] [call site] 00265
4 pki_import_pubkey_buffer [function] [call site] 00266
4 pki_import_pubkey_buffer [function] [call site] 00267
4 ssh_key_new [function] [call site] 00268
4 ssh_key_free [function] [call site] 00269
4 ssh_buffer_free [function] [call site] 00270
3 pki_import_pubkey_buffer [function] [call site] 00271
3 ssh_buffer_free [function] [call site] 00272
3 ssh_buffer_free [function] [call site] 00273
3 ssh_string_free [function] [call site] 00274
2 ssh_string_len [function] [call site] 00276
2 strlen [call site] 00277
2 ssh_string_data [function] [call site] 00278
2 strlen [call site] 00279
2 memcmp [call site] 00280
2 ssh_string_get_char [function] [call site] 00281
2 strcmp [call site] 00283
2 strcmp [call site] 00284
2 sshsig_prepare_data [function] [call site] 00286
3 strcmp [call site] 00288
3 sha256 [function] [call site] 00289
4 sha256_init [function] [call site] 00290
5 EVP_MD_CTX_new [call site] 00291
5 EVP_sha256 [call site] 00292
5 EVP_DigestInit_ex [call site] 00293
5 EVP_MD_CTX_free [call site] 00294
4 sha256_update [function] [call site] 00295
5 EVP_DigestUpdate [call site] 00296
4 EVP_MD_CTX_free [call site] 00297
4 sha256_final [function] [call site] 00298
5 EVP_DigestFinal [call site] 00299
5 EVP_MD_CTX_free [call site] 00300
3 strcmp [call site] 00301
3 sha512 [function] [call site] 00302
4 sha512_init [function] [call site] 00303
5 EVP_MD_CTX_new [call site] 00304
5 EVP_sha512 [call site] 00305
5 EVP_DigestInit_ex [call site] 00306
5 EVP_MD_CTX_free [call site] 00307
4 sha512_update [function] [call site] 00308
5 EVP_DigestUpdate [call site] 00309
4 EVP_MD_CTX_free [call site] 00310
4 sha512_final [function] [call site] 00311
5 EVP_DigestFinal [call site] 00312
5 EVP_MD_CTX_free [call site] 00313
3 ssh_string_new [function] [call site] 00316
3 ssh_string_fill [function] [call site] 00318
4 ssh_string_len [function] [call site] 00319
3 ssh_buffer_new [function] [call site] 00321
3 _ssh_buffer_pack [function] [call site] 00323
4 ssh_buffer_pack_allocate_va [function] [call site] 00324
5 ssh_string_len [function] [call site] 00325
5 strlen [call site] 00326
5 BN_num_bits [call site] 00327
5 strlen [call site] 00328
5 abort [call site] 00330
5 ssh_buffer_allocate_size [function] [call site] 00331
4 ssh_buffer_pack_va [function] [call site] 00332
5 ssh_buffer_add_u8 [function] [call site] 00333
6 ssh_buffer_add_data [function] [call site] 00334
5 htons [call site] 00335
5 ssh_buffer_add_u16 [function] [call site] 00336
6 ssh_buffer_add_data [function] [call site] 00337
5 htonl [call site] 00338
5 ssh_buffer_add_u32 [function] [call site] 00339
6 ssh_buffer_add_data [function] [call site] 00340
5 htonl [call site] 00341
5 ssh_buffer_add_u64 [function] [call site] 00342
6 ssh_buffer_add_data [function] [call site] 00343
5 ssh_buffer_add_ssh_string [function] [call site] 00344
5 strlen [call site] 00345
5 htonl [call site] 00346
5 ssh_buffer_add_u32 [function] [call site] 00347
5 ssh_buffer_add_data [function] [call site] 00348
5 ssh_buffer_add_data [function] [call site] 00349
5 ssh_make_padded_bignum_string [function] [call site] 00350
6 make_bignum_string [function] [call site] 00351
7 BN_num_bits [call site] 00352
7 BN_num_bits [call site] 00353
7 BN_is_bit_set [call site] 00354
7 ssh_string_new [function] [call site] 00355
7 BN_bn2bin [call site] 00356
5 ssh_make_bignum_string [function] [call site] 00357
6 make_bignum_string [function] [call site] 00358
5 ssh_buffer_add_ssh_string [function] [call site] 00359
5 strlen [call site] 00360
5 ssh_buffer_add_data [function] [call site] 00361
5 abort [call site] 00363
3 ssh_buffer_free [function] [call site] 00365
3 ssh_string_free [function] [call site] 00366
2 ssh_pki_import_signature_blob [function] [call site] 00368
3 ssh_buffer_new [function] [call site] 00369
3 ssh_string_data [function] [call site] 00370
3 ssh_string_len [function] [call site] 00371
3 ssh_buffer_add_data [function] [call site] 00372
3 ssh_buffer_free [function] [call site] 00373
3 ssh_buffer_get_ssh_string [function] [call site] 00374
3 ssh_buffer_free [function] [call site] 00375
3 ssh_string_get_char [function] [call site] 00376
3 ssh_key_type_from_signature_name [function] [call site] 00377
4 strcmp [call site] 00378
4 strcmp [call site] 00379
4 ssh_key_type_from_name [function] [call site] 00380
3 ssh_key_hash_from_name [function] [call site] 00381
4 strcmp [call site] 00382
4 strcmp [call site] 00383
4 strcmp [call site] 00384
4 strcmp [call site] 00385
4 strcmp [call site] 00386
4 strcmp [call site] 00387
4 strcmp [call site] 00388
4 strcmp [call site] 00389
4 strcmp [call site] 00390
3 ssh_string_free [function] [call site] 00392
3 ssh_buffer_get_ssh_string [function] [call site] 00393
3 ssh_buffer_free [function] [call site] 00394
3 _ssh_buffer_unpack [function] [call site] 00395
3 ssh_buffer_free [function] [call site] 00396
3 ssh_string_free [function] [call site] 00397
3 ssh_buffer_free [function] [call site] 00398
3 pki_signature_from_blob [function] [call site] 00399
4 ssh_key_type_plain [function] [call site] 00400
4 ssh_signature_new [function] [call site] 00402
5 calloc [call site] 00403
4 ssh_key_signature_to_char [function] [call site] 00404
5 ssh_key_type_to_char [function] [call site] 00405
4 pki_signature_from_rsa_blob [function] [call site] 00406
5 ssh_string_len [function] [call site] 00407
5 EVP_PKEY_get0_RSA [call site] 00408
5 RSA_size [call site] 00410
5 ssh_string_copy [function] [call site] 00412
6 ssh_string_len [function] [call site] 00413
6 ssh_string_new [function] [call site] 00414
5 ssh_string_new [function] [call site] 00416
5 ssh_string_data [function] [call site] 00417
5 ssh_string_data [function] [call site] 00418
5 explicit_bzero [call site] 00419
5 ssh_string_free [function] [call site] 00420
4 pki_signature_from_ed25519_blob [function] [call site] 00421
5 ssh_string_len [function] [call site] 00422
5 ssh_string_copy [function] [call site] 00424
4 pki_signature_from_ecdsa_blob [function] [call site] 00425
5 ssh_buffer_new [function] [call site] 00426
5 ssh_buffer_set_secure [function] [call site] 00427
5 ssh_string_data [function] [call site] 00428
5 ssh_string_len [function] [call site] 00429
5 ssh_buffer_add_data [function] [call site] 00430
5 ssh_buffer_get_ssh_string [function] [call site] 00431
5 ssh_make_string_bn [function] [call site] 00432
5 ssh_string_burn [function] [call site] 00433
5 ssh_string_free [function] [call site] 00434
5 ssh_buffer_get_ssh_string [function] [call site] 00435
5 ssh_buffer_get_len [function] [call site] 00436
5 ssh_buffer_free [function] [call site] 00437
5 ssh_string_burn [function] [call site] 00438
5 ssh_string_free [function] [call site] 00439
5 ssh_make_string_bn [function] [call site] 00441
5 ssh_string_burn [function] [call site] 00442
5 ssh_string_free [function] [call site] 00443
5 ECDSA_SIG_new [call site] 00444
5 ECDSA_SIG_set0 [call site] 00445
5 i2d_ECDSA_SIG [call site] 00446
5 calloc [call site] 00447
5 i2d_ECDSA_SIG [call site] 00448
5 ssh_string_new [function] [call site] 00449
5 explicit_bzero [call site] 00450
5 ssh_string_fill [function] [call site] 00451
5 explicit_bzero [call site] 00452
5 explicit_bzero [call site] 00453
5 ECDSA_SIG_free [call site] 00454
5 ssh_buffer_free [function] [call site] 00455
5 BN_clear_free [call site] 00456
5 BN_clear_free [call site] 00457
5 ECDSA_SIG_free [call site] 00458
4 ssh_signature_free [function] [call site] 00460
5 ssh_string_burn [function] [call site] 00461
5 ssh_string_free [function] [call site] 00462
3 ssh_string_free [function] [call site] 00463
2 ssh_buffer_get [function] [call site] 00465
2 ssh_buffer_get_len [function] [call site] 00466
2 pki_verify_data_signature [function] [call site] 00467
3 ssh_key_is_private [function] [call site] 00468
3 pki_key_check_hash_compatible [function] [call site] 00470
4 FIPS_mode [call site] 00472
3 ssh_string_data [function] [call site] 00476
3 ssh_string_len [function] [call site] 00477
3 pki_digest_to_md [function] [call site] 00478
4 EVP_sha256 [call site] 00479
4 EVP_sha384 [call site] 00480
4 EVP_sha512 [call site] 00481
4 EVP_sha1 [call site] 00482
3 pki_key_to_pkey [function] [call site] 00484
4 EVP_PKEY_up_ref [call site] 00486
4 EVP_PKEY_free [call site] 00489
3 EVP_MD_CTX_new [call site] 00490
3 ERR_get_error [call site] 00491
3 ERR_error_string [call site] 00492
3 EVP_DigestVerifyInit [call site] 00494
3 ERR_get_error [call site] 00495
3 ERR_error_string [call site] 00496
3 EVP_DigestVerify [call site] 00498
3 ERR_get_error [call site] 00499
3 ERR_error_string [call site] 00500
3 EVP_MD_CTX_free [call site] 00503
3 EVP_PKEY_free [call site] 00504
2 ssh_string_free [function] [call site] 00506
2 ssh_string_free [function] [call site] 00507
2 ssh_string_free [function] [call site] 00508
2 ssh_string_free [function] [call site] 00509
2 ssh_buffer_free [function] [call site] 00510
2 ssh_buffer_free [function] [call site] 00511
2 ssh_key_free [function] [call site] 00512
2 ssh_signature_free [function] [call site] 00513
1 ssh_key_free [function] [call site] 00514