High level conclusions

Fuzzers reach 52.34% code coverage.

Fuzzers reach 60.80% of cyclomatic complexity.

Fuzzers reach 56.63% of all functions.

Fuzzer ssh_bind_config_fuzzer is blocked:

The runtime code coverage of ssh_bind_config_fuzzer covers 17.89% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ssh_privkey_fuzzer is blocked:

The runtime code coverage of ssh_privkey_fuzzer covers 10.46% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ssh_client_config_fuzzer is blocked:

The runtime code coverage of ssh_client_config_fuzzer covers 29.90% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ssh_sshsig_fuzzer is blocked:

The runtime code coverage of ssh_sshsig_fuzzer covers 10.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

555 / 980

Cyclomatic complexity statically reachable by fuzzers

4978 / 8187

Runtime code coverage of functions

513 / 980

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: ssh_sshsig_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	465	90.2%
gold	[1:9]	12	2.33%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	11	2.13%
lawngreen	50+	27	5.24%
All colors	515	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
21	21	4 : View List ['ssh_threads_finalize', 'ssh_dh_finalize', 'ssh_socket_cleanup', 'ssh_crypto_finalize']	21	33	_ssh_finalize	call site: 00000	/src/libssh/src/init.c:165
10	10	1 : View List ['ssh_dh_finalize']	10	10	ssh_dh_init	call site: 00000	/src/libssh/src/dh.c:260
6	6	1 : View List ['buffer_shift']	6	19	ssh_buffer_add_data	call site: 00056	/src/libssh/src/buffer.c:318
6	6	1 : View List ['buffer_shift']	6	19	ssh_buffer_allocate_size	call site: 00042	/src/libssh/src/buffer.c:347
4	39	3 : View List ['OpenSSL_version', '_ssh_log', 'OpenSSL_version_num']	4	39	ssh_crypto_init	call site: 00000	/src/libssh/src/libcrypto.c:1381
2	2	1 : View List ['exit']	2	2	ssh_mutex_lock	call site: 00000	/src/libssh/src/threads/pthread.c:111
2	2	1 : View List ['exit']	2	2	ssh_mutex_unlock	call site: 00000	/src/libssh/src/threads/pthread.c:126
0	10	1 : View List ['ssh_buffer_free']	0	10	base64_to_bin	call site: 00060	/src/libssh/src/base64.c:125
0	10	1 : View List ['ssh_buffer_free']	0	10	base64_to_bin	call site: 00062	/src/libssh/src/base64.c:144
0	10	1 : View List ['ssh_buffer_free']	0	10	base64_to_bin	call site: 00064	/src/libssh/src/base64.c:162
0	0	None	21	27	_ssh_finalize	call site: 00000	/src/libssh/src/init.c:162
0	0	None	10	10	ssh_dh_init	call site: 00000	/src/libssh/src/dh.c:239

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

142

Reachable functions

159

Percentage of reachable functions covered

10.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_sshsig_fuzzer.c	1
src/pki.c	20
src/log.c	9
src/base64.c	4
src/buffer.c	27
src/string.c	9
src/bignum.c	4
src/pki_crypto.c	11
src/md_crypto.c	8
src/pki_ed25519_common.c	1

Fuzzer: ssh_client_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	297	37.5%
gold	[1:9]	95	12.0%
yellow	[10:29]	40	5.05%
greenyellow	[30:49]	16	2.02%
lawngreen	50+	343	43.3%
All colors	791	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
133	1107	9 : View List ['ssh_config_get_match_opcode', 'ssh_config_get_str_tok', 'ssh_get_local_username', 'ssh_match_localnetwork', 'ssh_match_exec', 'ssh_config_match', '_ssh_log', 'match_cidr_address_list', 'ssh_config_get_token']	133	1338	ssh_config_parse_line	call site: 00532	/src/libssh/src/config.c:976
68	68	1 : View List ['ssh_message_free']	91	291	ssh_free	call site: 00181	/src/libssh/src/session.c:276
25	25	1 : View List ['ssh_poll_ctx_free']	116	771	ssh_free	call site: 00113	/src/libssh/src/session.c:249
21	21	1 : View List ['ssh_kbdint_free']	23	205	ssh_free	call site: 00189	/src/libssh/src/session.c:287
21	21	4 : View List ['ssh_threads_finalize', 'ssh_dh_finalize', 'ssh_socket_cleanup', 'ssh_crypto_finalize']	21	33	_ssh_finalize	call site: 00781	/src/libssh/src/init.c:165
18	18	1 : View List ['ssh_poll_free']	31	136	ssh_socket_close	call site: 00117	/src/libssh/src/socket.c:484
10	10	1 : View List ['ssh_dh_finalize']	10	10	ssh_dh_init	call site: 00045	/src/libssh/src/dh.c:260
6	6	1 : View List ['buffer_shift']	6	19	ssh_buffer_allocate_size	call site: 00068	/src/libssh/src/buffer.c:347
4	39	3 : View List ['OpenSSL_version', '_ssh_log', 'OpenSSL_version_num']	4	39	ssh_crypto_init	call site: 00012	/src/libssh/src/libcrypto.c:1381
4	4	1 : View List ['explicit_bzero']	4	4	ssh_buffer_free	call site: 00077	/src/libssh/src/buffer.c:157
3	3	1 : View List ['ssh_pcap_context_free']	119	867	ssh_free	call site: 00111	/src/libssh/src/session.c:240
2	7	2 : View List ['ssh_is_ipaddr_v4', 'inet_pton']	2	7	ssh_is_ipaddr	call site: 00248	/src/libssh/src/misc.c:412

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

225

Reachable functions

321

Percentage of reachable functions covered

29.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_client_config_fuzzer.c	1
src/init.c	4
src/threads/pthread.c	3
src/threads.c	2
src/threads/libcrypto.c	2
src/libcrypto.c	2
src/log.c	12
src/dh.c	2
src/socket.c	6
src/poll.c	6
src/session.c	3
src/wrapper.c	4
src/error.c	3
src/buffer.c	5
src/misc.c	21
src/agent.c	3
src/channels.c	1
src/pcap.c	1
src/pki.c	2
src/pki_crypto.c	1
src/string.c	4
src/dh_crypto.c	1
src/gzip.c	1
src/messages.c	1
src/auth.c	2
src/callbacks.c	1
src/options.c	2
src/config_parser.c	6
src/kex.c	6
src/token.c	7
src/config.c	11
src/match.c	8

Fuzzer: ssh_pubkey_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	411	60.8%
gold	[1:9]	55	8.14%
yellow	[10:29]	12	1.77%
greenyellow	[30:49]	24	3.55%
lawngreen	50+	173	25.6%
All colors	675	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
204	281	3 : View List ['ssh_key_free', '_ssh_log', 'ssh_pki_export_privkey_to_pubkey']	204	281	ssh_pki_import_pubkey_file	call site: 00535	/src/libssh/src/pki.c:2062
35	104	8 : View List ['ssh_key_new', 'pki_key_ecdsa_to_nid', 'pki_key_ecdsa_to_key_type', 'ssh_key_free', 'EVP_PKEY_get0_EC_KEY', 'EVP_PKEY_base_id', 'ssh_key_type_to_char', 'EVP_PKEY_free']	39	213	pki_private_key_from_base64	call site: 00542	/src/libssh/src/pki_crypto.c:1157
21	21	4 : View List ['ssh_threads_finalize', 'ssh_dh_finalize', 'ssh_socket_cleanup', 'ssh_crypto_finalize']	21	33	_ssh_finalize	call site: 00665	/src/libssh/src/init.c:165
10	10	1 : View List ['ssh_dh_finalize']	10	10	ssh_dh_init	call site: 00044	/src/libssh/src/dh.c:260
7	7	2 : View List ['ssh_strerror', '__errno_location']	7	42	ssh_pki_import_pubkey_file	call site: 00083	/src/libssh/src/pki.c:2035
6	6	1 : View List ['buffer_shift']	6	19	ssh_buffer_add_data	call site: 00117	/src/libssh/src/buffer.c:318
6	6	1 : View List ['buffer_shift']	6	19	ssh_buffer_allocate_size	call site: 00103	/src/libssh/src/buffer.c:347
4	39	3 : View List ['OpenSSL_version', '_ssh_log', 'OpenSSL_version_num']	4	39	ssh_crypto_init	call site: 00011	/src/libssh/src/libcrypto.c:1381
4	39	3 : View List ['ERR_get_error', 'ERR_error_string', '_ssh_log']	4	39	pki_pubkey_build_ed25519	call site: 00297	/src/libssh/src/pki_crypto.c:471
4	4	2 : View List ['RSA_free', 'EVP_PKEY_free']	4	4	pki_pubkey_build_rsa	call site: 00244	/src/libssh/src/pki_crypto.c:1447
2	2	1 : View List ['abort']	2	2	ssh_buffer_unpack_va	call site: 00169	/src/libssh/src/buffer.c:1295
2	2	1 : View List ['EC_KEY_free']	2	2	pki_pubkey_build_ecdsa	call site: 00277	/src/libssh/src/pki_crypto.c:384

Runtime coverage analysis

Covered functions

64

Functions that are reachable but not covered

132

Reachable functions

195

Percentage of reachable functions covered

32.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_pubkey_fuzzer.c	1
src/init.c	4
src/threads/pthread.c	3
src/threads.c	2
src/threads/libcrypto.c	2
src/libcrypto.c	3
src/log.c	9
src/dh.c	2
src/socket.c	2
src/poll.c	2
src/misc.c	2
src/pki.c	15
src/pki_container_openssh.c	4
src/base64.c	4
src/buffer.c	19
src/string.c	8
src/bignum.c	1
src/pki_crypto.c	13
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	3
src/external/blowfish.c	6
src/wrapper.c	1

Fuzzer: ssh_privkey_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	511	93.0%
gold	[1:9]	18	3.27%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	20	3.64%
All colors	549	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
674	674	1 : View List ['ssh_pki_openssh_privkey_import']	674	674	ssh_pki_import_privkey_base64	call site: 00061	/src/libssh/src/pki.c:938
104	104	8 : View List ['ssh_key_new', 'pki_key_ecdsa_to_nid', 'pki_key_ecdsa_to_key_type', 'ssh_key_free', 'EVP_PKEY_get0_EC_KEY', 'EVP_PKEY_base_id', 'ssh_key_type_to_char', 'EVP_PKEY_free']	108	213	pki_private_key_from_base64	call site: 00514	/src/libssh/src/pki_crypto.c:1157
10	10	1 : View List ['ssh_dh_finalize']	10	10	ssh_dh_init	call site: 00046	/src/libssh/src/dh.c:260
4	39	3 : View List ['OpenSSL_version', '_ssh_log', 'OpenSSL_version_num']	4	39	ssh_crypto_init	call site: 00013	/src/libssh/src/libcrypto.c:1381
2	2	1 : View List ['exit']	2	2	ssh_mutex_lock	call site: 00007	/src/libssh/src/threads/pthread.c:111
2	2	1 : View List ['exit']	2	2	ssh_mutex_unlock	call site: 00057	/src/libssh/src/threads/pthread.c:126
0	0	None	676	862	ssh_pki_import_privkey_base64	call site: 00059	/src/libssh/src/pki.c:928
0	0	None	116	256	pki_private_key_from_base64	call site: 00508	/src/libssh/src/pki_crypto.c:1142
0	0	None	116	256	pki_private_key_from_base64	call site: 00508	/src/libssh/src/pki_crypto.c:1143
0	0	None	10	10	ssh_dh_init	call site: 00037	/src/libssh/src/dh.c:239
0	0	None	10	10	ssh_dh_init	call site: 00038	/src/libssh/src/dh.c:243
0	0	None	10	10	ssh_dh_init	call site: 00040	/src/libssh/src/dh.c:248

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

154

Reachable functions

172

Percentage of reachable functions covered

10.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_privkey_fuzzer.c	1
src/base64.c	6
src/init.c	4
src/threads/pthread.c	3
src/threads.c	2
src/threads/libcrypto.c	2
src/libcrypto.c	3
src/log.c	9
src/dh.c	2
src/socket.c	2
src/poll.c	2
src/pki.c	11
src/pki_container_openssh.c	4
src/buffer.c	19
src/string.c	7
src/bignum.c	1
src/pki_crypto.c	12
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	3
src/external/blowfish.c	6
src/wrapper.c	1

Fuzzer: ssh_known_hosts_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	114	27.2%
gold	[1:9]	21	5.01%
yellow	[10:29]	3	0.71%
greenyellow	[30:49]	1	0.23%
lawngreen	50+	280	66.8%
All colors	419	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
21	21	4 : View List ['ssh_threads_finalize', 'ssh_dh_finalize', 'ssh_socket_cleanup', 'ssh_crypto_finalize']	21	33	_ssh_finalize	call site: 00408	/src/libssh/src/init.c:165
10	10	1 : View List ['ssh_dh_finalize']	10	10	ssh_dh_init	call site: 00050	/src/libssh/src/dh.c:260
7	42	3 : View List ['ssh_strerror', '__errno_location', '_ssh_log']	7	42	ssh_known_hosts_read_entries	call site: 00064	/src/libssh/src/knownhosts.c:236
6	6	1 : View List ['buffer_shift']	6	19	ssh_buffer_add_data	call site: 00106	/src/libssh/src/buffer.c:318
6	6	1 : View List ['buffer_shift']	6	19	ssh_buffer_allocate_size	call site: 00092	/src/libssh/src/buffer.c:347
4	39	3 : View List ['OpenSSL_version', '_ssh_log', 'OpenSSL_version_num']	4	39	ssh_crypto_init	call site: 00017	/src/libssh/src/libcrypto.c:1381
4	39	3 : View List ['ERR_get_error', 'ERR_error_string', '_ssh_log']	4	39	pki_pubkey_build_ed25519	call site: 00322	/src/libssh/src/pki_crypto.c:471
4	4	1 : View List ['ssh_key_is_private']	6	127	ssh_key_cmp	call site: 00366	/src/libssh/src/pki.c:778
4	4	2 : View List ['RSA_free', 'EVP_PKEY_free']	4	4	pki_pubkey_build_rsa	call site: 00268	/src/libssh/src/pki_crypto.c:1447
2	12	3 : View List ['ssh_buffer_get', 'memcmp', 'ssh_buffer_get_len']	2	12	ssh_key_cmp	call site: 00374	/src/libssh/src/pki.c:805
2	2	1 : View List ['abort']	2	2	ssh_buffer_unpack_va	call site: 00250	/src/libssh/src/buffer.c:1295
2	2	1 : View List ['EVP_MD_CTX_free']	2	2	hmac_init	call site: 00133	/src/libssh/src/libcrypto.c:376

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

95

Reachable functions

176

Percentage of reachable functions covered

46.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_known_hosts_fuzzer.c	1
src/init.c	4
src/threads/pthread.c	3
src/threads.c	2
src/threads/libcrypto.c	2
src/libcrypto.c	5
src/log.c	9
src/dh.c	2
src/socket.c	2
src/poll.c	2
src/knownhosts.c	7
src/misc.c	8
src/base64.c	4
src/buffer.c	19
src/match.c	3
src/pki.c	11
src/string.c	8
src/bignum.c	1
src/pki_crypto.c	6

Fuzzer: ssh_bind_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	622	74.4%
gold	[1:9]	43	5.14%
yellow	[10:29]	20	2.39%
greenyellow	[30:49]	15	1.79%
lawngreen	50+	136	16.2%
All colors	836	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
735	735	7 : View List ['fread', 'free', 'fileno', 'fstat', 'ssh_pki_import_privkey_base64', 'malloc', 'fclose']	741	891	ssh_pki_import_privkey_file	call site: 00583	/src/libssh/src/pki.c:1124
721	721	1 : View List ['ssh_pki_import_privkey_base64']	876	1185	ssh_bind_options_set	call site: 00103	/src/libssh/src/options.c:2263
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_config_parse_line	call site: 00069	/src/libssh/src/bind_config.c:309
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00102	/src/libssh/src/options.c:2254
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00629	/src/libssh/src/options.c:2353
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00637	/src/libssh/src/options.c:2395
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00648	/src/libssh/src/options.c:2438
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00650	/src/libssh/src/options.c:2453
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00726	/src/libssh/src/options.c:2468
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00728	/src/libssh/src/options.c:2483
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00730	/src/libssh/src/options.c:2498
35	35	1 : View List ['_ssh_set_error_invalid']	35	35	ssh_bind_options_set	call site: 00749	/src/libssh/src/options.c:2529

Runtime coverage analysis

Covered functions

52

Functions that are reachable but not covered

234

Reachable functions

285

Percentage of reachable functions covered

17.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_bind_config_fuzzer.c	1
src/init.c	4
src/threads/pthread.c	3
src/threads.c	2
src/threads/libcrypto.c	2
src/libcrypto.c	3
src/log.c	10
src/dh.c	2
src/socket.c	2
src/poll.c	2
src/bind.c	2
src/bind_config.c	6
src/error.c	3
src/config_parser.c	2
src/options.c	5
src/pki.c	14
src/pki_container_openssh.c	4
src/base64.c	4
src/buffer.c	19
src/string.c	7
src/bignum.c	1
src/pki_crypto.c	14
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	3
src/external/blowfish.c	6
src/wrapper.c	1
src/misc.c	3
src/kex.c	6
src/token.c	7

Fuzzer: ssh_client_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2475	73.5%
gold	[1:9]	56	1.66%
yellow	[10:29]	50	1.48%
greenyellow	[30:49]	21	0.62%
lawngreen	50+	761	22.6%
All colors	3363	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2653	2659	3 : View List ['ssh_channel_do_free', 'ssh_channel_close', 'ssh_list_free']	2653	2659	ssh_channel_free	call site: 03336	/src/libssh/src/channels.c:1276
2443	2513	2 : View List ['_ssh_log', 'ssh_send_rekex']	2443	2513	ssh_packet_socket_callback	call site: 00000	/src/libssh/src/packet.c:1494
801	814	10 : View List ['ssh_known_hosts_parse_line', 'ssh_known_hosts_entries_compare', '__ctype_b_loc', 'strcspn', 'ssh_list_get_iterator', 'ssh_knownhosts_entry_free', 'known_hosts_read_line', 'ssh_list_append', 'ssh_list_new', 'fclose']	801	814	ssh_known_hosts_read_entries	call site: 01056	/src/libssh/src/knownhosts.c:236
263	263	2 : View List ['strlen', 'ssh_pcap_context_write']	263	263	ssh_send_banner	call site: 00000	/src/libssh/src/client.c:234
259	261	2 : View List ['ssh_buffer_get', 'ssh_pcap_context_write']	2833	10951	ssh_packet_socket_callback	call site: 00000	/src/libssh/src/packet.c:1363
259	259	1 : View List ['ssh_pcap_context_write']	259	1329	packet_send2	call site: 01633	/src/libssh/src/packet.c:1841
247	2785	6 : View List ['ssh_string_data', 'ssh_packet_send', 'ssh_sntrup761x25519_build_k', 'ssh_buffer_add_u8', 'ssh_buffer_get_ssh_string', '_ssh_log']	247	2854	ssh_packet_client_sntrup761x25519_reply	call site: 00000	/src/libssh/src/sntrup761.c:270
245	245	1 : View List ['server_set_kex']	253	915	ssh_packet_kexinit	call site: 00000	/src/libssh/src/kex.c:414
216	252	9 : View List ['ssh_known_host_sigs_from_hostkey_type', 'strncat', 'ssh_list_free', 'strlen', 'ssh_list_get_iterator', 'ssh_knownhosts_entry_free', 'ssh_list_count', 'ssh_remove_duplicates', 'ssh_list_remove']	216	252	ssh_known_hosts_get_algorithms_names	call site: 01515	/src/libssh/src/knownhosts.c:571
172	172	1 : View List ['pki_buffer_pack_sk_priv_data']	174	349	pki_key_to_blob	call site: 01792	/src/libssh/src/pki_crypto.c:1798
172	172	1 : View List ['pki_buffer_pack_sk_priv_data']	174	349	pki_key_to_blob	call site: 01821	/src/libssh/src/pki_crypto.c:1956
123	170	6 : View List ['free', 'ssh_append_without_duplicates', 'ssh_keep_fips_algos', '_ssh_set_error_oom', 'ssh_find_all_matching', 'FIPS_mode']	123	310	ssh_client_select_hostkeys	call site: 01508	/src/libssh/src/kex.c:718

Runtime coverage analysis

Covered functions

332

Functions that are reachable but not covered

438

Reachable functions

706

Percentage of reachable functions covered

37.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_client_fuzzer.c	2
src/init.c	5
src/threads/pthread.c	3
src/threads.c	3
src/threads/libcrypto.c	2
src/libcrypto.c	8
src/log.c	13
src/dh.c	6
src/socket.c	25
src/poll.c	27
src/session.c	9
src/wrapper.c	10
src/error.c	4
src/buffer.c	31
src/misc.c	28
src/agent.c	11
src/channels.c	31
src/pcap.c	5
src/pki.c	43
src/pki_crypto.c	22
src/string.c	12
src/dh_crypto.c	6
src/gzip.c	4
src/messages.c	1
src/auth.c	13
src/callbacks.c	6
src/options.c	4
src/config_parser.c	6
src/kex.c	18
src/token.c	7
src/config.c	12
src/client.c	7
src/match.c	9
src/connect.c	4
src/knownhosts.c	14
src/base64.c	6
src/bignum.c	4
src/packet.c	10
src/getrandom_crypto.c	1
src/server.c	1
src/packet_crypt.c	1
src/md_crypto.c	20
src/kdf.c	5
src/dh-gex.c	1
src/ecdh_crypto.c	3
src/curve25519.c	1
src/curve25519_crypto.c	1
src/sntrup761.c	4
src/external/sntrup761.c	24
src/pki_container_openssh.c	5
src/external/bcrypt_pbkdf.c	2
src/external/blowfish.c	6
src/pki_ed25519_common.c	1
src/connector.c	17

Fuzzer: ssh_server_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1446	63.9%
gold	[1:9]	19	0.84%
yellow	[10:29]	23	1.01%
greenyellow	[30:49]	9	0.39%
lawngreen	50+	764	33.7%
All colors	2261	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2506	2506	1 : View List ['ssh_execute_message_callback']	2506	2506	ssh_message_queue	call site: 00000	/src/libssh/src/messages.c:505
2453	2548	10 : View List ['strchr', 'free', 'calloc', 'dh_handshake', 'strlen', 'ssh_string_free', '_ssh_log', 'ssh_buffer_reinit', '_ssh_set_error_oom', 'kex_select_kex_type']	2453	2548	ssh_send_kex	call site: 02078	/src/libssh/src/kex.c:1136
2443	2513	2 : View List ['_ssh_log', 'ssh_send_rekex']	2443	2513	ssh_packet_socket_callback	call site: 00000	/src/libssh/src/packet.c:1494
1320	1320	1 : View List ['ssh_set_client_kex']	1328	1990	ssh_packet_kexinit	call site: 00000	/src/libssh/src/kex.c:414
770	770	1 : View List ['ssh_bind_import_keys']	782	1394	ssh_bind_accept_fd	call site: 00936	/src/libssh/src/bind.c:524
674	674	1 : View List ['ssh_pki_openssh_privkey_import']	674	674	ssh_pki_import_privkey_base64	call site: 00210	/src/libssh/src/pki.c:938
351	3144	6 : View List ['ssh_get_server_publickey', 'strcmp', 'ssh_message_queue', 'ssh_string_free', 'ssh_key_free', 'ssh_key_cmp']	351	3352	ssh_packet_userauth_request	call site: 00000	/src/libssh/src/messages.c:1039
263	263	2 : View List ['strlen', 'ssh_pcap_context_write']	263	263	ssh_send_banner	call site: 01057	/src/libssh/src/client.c:234
259	261	2 : View List ['ssh_buffer_get', 'ssh_pcap_context_write']	2833	10951	ssh_packet_socket_callback	call site: 00000	/src/libssh/src/packet.c:1363
259	259	1 : View List ['ssh_pcap_context_write']	259	1329	packet_send2	call site: 01721	/src/libssh/src/packet.c:1841
172	172	1 : View List ['pki_buffer_pack_sk_priv_data']	174	349	pki_key_to_blob	call site: 01829	/src/libssh/src/pki_crypto.c:1798
172	172	1 : View List ['pki_buffer_pack_sk_priv_data']	174	349	pki_key_to_blob	call site: 01857	/src/libssh/src/pki_crypto.c:1956

Runtime coverage analysis

Covered functions

376

Functions that are reachable but not covered

280

Reachable functions

513

Percentage of reachable functions covered

45.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_server_fuzzer.c	2
src/bind.c	4
src/session.c	7
src/wrapper.c	10
src/socket.c	16
src/error.c	3
src/buffer.c	31
src/misc.c	28
src/agent.c	3
src/channels.c	1
src/pcap.c	5
src/poll.c	20
src/log.c	12
src/pki.c	22
src/pki_crypto.c	18
src/string.c	11
src/dh_crypto.c	6
src/gzip.c	4
src/messages.c	1
src/auth.c	2
src/callbacks.c	2
src/options.c	7
src/pki_container_openssh.c	4
src/base64.c	4
src/bignum.c	4
src/libcrypto.c	7
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	20
src/external/blowfish.c	6
src/kex.c	18
src/token.c	7
src/server.c	4
src/client.c	3
src/getrandom_crypto.c	1
src/packet.c	10
src/knownhosts.c	10
src/config_parser.c	1
src/config.c	1
src/match.c	3
src/packet_crypt.c	1
src/dh.c	3
src/kdf.c	5
src/dh-gex.c	1
src/ecdh_crypto.c	3
src/curve25519.c	1
src/curve25519_crypto.c	1
src/sntrup761.c	4
src/external/sntrup761.c	24

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
ssh_packet_userauth_request	/src/libssh/src/messages.c	4	['N/A', 'char', 'N/A', 'N/A']	34	0	920	187	54	451	0	3035	290
ssh_packet_socket_callback	/src/libssh/src/packet.c	3	['N/A', 'size_t', 'N/A']	26	0	1020	133	47	407	1	2693	240
ssh_channel_request_pty	/src/libssh/src/channels.c	1	['N/A']	25	0	16	3	2	429	0	2755	163
ssh_server_connection_callback	/src/libssh/src/server.c	1	['N/A']	28	0	494	85	25	415	0	2626	158
ssh_packet_server_sntrup761x25519_init	/src/libssh/src/sntrup761.c	4	['N/A', 'char', 'N/A', 'N/A']	27	0	410	64	24	452	0	2858	143
ssh_packet_server_dhgex_request	/src/libssh/src/dh-gex.c	4	['N/A', 'char', 'N/A', 'N/A']	17	0	296	51	18	400	0	2540	97
ssh_pki_export_privkey_file	/src/libssh/src/pki.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	13	0	32	3	2	122	0	569	89
channel_rcv_request	/src/libssh/src/channels.c	4	['N/A', 'char', 'N/A', 'N/A']	22	0	763	137	43	418	0	2738	69
ssh_channel_select	/src/libssh/src/channels.c	4	['N/A', 'N/A', 'N/A', 'N/A']	11	0	657	137	40	88	0	410	67
ssh_packet_kexinit	/src/libssh/src/kex.c	4	['N/A', 'char', 'N/A', 'N/A']	15	0	975	164	54	216	0	1448	67

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

674 / 980

Cyclomatic complexity statically reachable by fuzzers

6272 / 8187

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzz/ssh_sshsig_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshsig_verify', '_ssh_log', 'ssh_buffer_new', 'LLVMFuzzerTestOneInput', 'sshsig_dearmor', 'base64_to_bin']

tests/fuzz/ssh_client_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_ssh_log', 'ssh_socket_close', 'ssh_options_set', 'ssh_free', 'crypto_free', 'ssh_config_parse_line', 'match_cidr_address_list']

tests/fuzz/ssh_pubkey_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_pki_openssh_import', 'pki_private_key_from_base64', '_ssh_log', 'ssh_pki_import_pubkey_file', '_ssh_finalize', 'ssh_dh_init', 'ssh_buffer_unpack_va']

tests/fuzz/ssh_privkey_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_pki_import_privkey_base64', 'pki_private_key_from_base64', '_ssh_log', 'ssh_dh_init', 'ssh_crypto_init', '_ssh_init', 'ssh_mutex_lock', 'ssh_mutex_unlock']

tests/fuzz/ssh_known_hosts_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_ssh_log', 'ssh_buffer_unpack_va', '_ssh_finalize', 'ssh_string_cmp', 'ssh_dh_init', 'hmac_init', 'ssh_known_hosts_read_entries', 'ssh_crypto_init']

tests/fuzz/ssh_bind_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_bind_config_parse_line', 'ssh_pki_import_privkey_file', 'ssh_bind_options_set', '_ssh_finalize', 'ssh_dh_init', 'ssh_crypto_init', 'ssh_log_function']

tests/fuzz/ssh_client_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_pki_import_pubkey_blob', 'ssh_signature_free', 'ssh_userauth_get_response', 'ssh_path_expand_escape', 'ssh_lowercase', 'ssh_string_copy', 'pki_import_cert_buffer', 'ssh_connect', 'ssh_options_set', 'ssh_client_sntrup761x25519_init']

tests/fuzz/ssh_server_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_list_prepend', 'sha512_final', 'ssh_packet_send', 'ssh_buffer_pack_va', 'pki_key_dup', 'ssh_bind_options_set', 'ssh_find_all_matching', 'ssh_pki_import_pubkey_blob', 'packet_send2', 'cipher_new']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ssh_dh_init	36	19	52.77%	['ssh_bind_config_fuzzer', 'ssh_sshsig_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_config_fuzzer', 'ssh_server_fuzzer', 'ssh_privkey_fuzzer', 'ssh_client_fuzzer']
sshsig_verify	121	30	24.79%	['ssh_sshsig_fuzzer']
ssh_config_make_absolute	41	19	46.34%	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
match_cidr_address_list	168	84	50.0%	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
ssh_options_set	690	376	54.49%	['ssh_client_config_fuzzer', 'ssh_server_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
ssh_socket_close	33	15	45.45%	['ssh_client_config_fuzzer', 'ssh_server_fuzzer', 'ssh_client_fuzzer']
pki_private_key_from_base64	78	40	51.28%	['ssh_bind_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_client_config_fuzzer', 'ssh_server_fuzzer', 'ssh_privkey_fuzzer', 'ssh_client_fuzzer']
pki_pubkey_build_rsa	33	18	54.54%	['ssh_bind_config_fuzzer', 'ssh_sshsig_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_config_fuzzer', 'ssh_server_fuzzer', 'ssh_privkey_fuzzer', 'ssh_client_fuzzer']
hmac_init	38	17	44.73%	['ssh_server_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer']
ssh_key_cmp	47	16	34.04%	['ssh_server_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer']
ssh_bind_options_set	360	179	49.72%	['ssh_client_config_fuzzer', 'ssh_server_fuzzer', 'ssh_bind_config_fuzzer']
ssh_pki_import_privkey_file	63	33	52.38%	['ssh_client_config_fuzzer', 'ssh_server_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
ssh_userauth_get_response	41	7	17.07%	['ssh_client_fuzzer']
ssh_channel_free	38	5	13.15%	['ssh_client_fuzzer']
ssh_connect	121	60	49.58%	['ssh_client_fuzzer']
ssh_curve25519_init	46	24	52.17%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
sshkdf_derive_key	73	25	34.24%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_mac_ctx_init	36	19	52.77%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_client_select_hostkeys	70	27	38.57%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_send_kex	89	48	53.93%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_hashbufout_add_cookie	31	17	54.83%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
revert_kex_callbacks	35	5	14.28%	['ssh_client_fuzzer']
ssh_known_hosts_get_algorithms_names	75	25	33.33%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_options_apply	121	53	43.80%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_packet_send	62	24	38.70%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_packet_encrypt	90	37	41.11%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_key_signature_to_char	33	16	48.48%	['ssh_client_fuzzer', 'ssh_server_fuzzer', 'ssh_sshsig_fuzzer']
pki_key_to_blob	336	128	38.09%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_packet_client_sntrup761x25519_reply	64	35	54.68%	['ssh_client_fuzzer']
ssh_bind_accept_fd	112	41	36.60%	['ssh_server_fuzzer']
ssh_channel_new	44	22	50.0%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
channel_default_bufferize	45	18	40.0%	['ssh_server_fuzzer']
ssh_retrieve_dhgroup	52	16	30.76%	['ssh_server_fuzzer']
ssh_message_queue	35	18	51.42%	['ssh_server_fuzzer']
ssh_execute_server_request	230	80	34.78%	['ssh_server_fuzzer']
ssh_msg_userauth_build_digest	53	29	54.71%	['ssh_server_fuzzer']
pki_key_dup_common_init	38	15	39.47%	['ssh_pubkey_fuzzer', 'ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_pki_export_signature_blob	54	26	48.14%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
pki_key_dup	222	59	26.57%	['ssh_pubkey_fuzzer', 'ssh_server_fuzzer', 'ssh_client_fuzzer']
pki_sign_data	82	44	53.65%	['ssh_server_fuzzer', 'ssh_client_fuzzer']
ssh_get_key_params	44	20	45.45%	['ssh_server_fuzzer']
ssh_auth_reply_default	44	12	27.27%	['ssh_server_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libssh/src/sntrup761.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/tests/fuzz/ssh_pubkey_fuzzer.c	['ssh_pubkey_fuzzer']	['ssh_pubkey_fuzzer']
/src/libssh/src/bind.c	['ssh_bind_config_fuzzer', 'ssh_server_fuzzer']	['ssh_bind_config_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/external/blowfish.c	['ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	[]
/src/libssh/tests/fuzz/ssh_client_fuzzer.c	['ssh_client_fuzzer']	['ssh_client_fuzzer']
/src/libssh/src/ecdh.c	[]	[]
/src/libssh/src/packet_crypt.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/server.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/bind_config.c	['ssh_bind_config_fuzzer']	['ssh_bind_config_fuzzer']
/src/libssh/src/ttyopts.c	[]	[]
/src/libssh/src/threads/pthread.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
/src/libssh/tests/fuzz/ssh_server_fuzzer.c	['ssh_server_fuzzer']	['ssh_server_fuzzer']
/src/libssh/src/external/sntrup761.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/kdf.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/dh_crypto.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/threads.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
/src/libssh/src/dh-gex.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/knownhosts.c	['ssh_known_hosts_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_known_hosts_fuzzer', 'ssh_client_fuzzer']
/src/libssh/src/threads/libcrypto.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
/src/libssh/src/packet_cb.c	[]	[]
/src/libssh/src/channels.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/external/bcrypt_pbkdf.c	['ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	[]
/src/libssh/src/agent.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/session.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/options.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/tests/fuzz/ssh_bind_config_fuzzer.c	['ssh_bind_config_fuzzer']	['ssh_bind_config_fuzzer']
/src/libssh/src/curve25519.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/pki_container_openssh.c	['ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_pubkey_fuzzer']
/src/libssh/src/pcap.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	[]
/src/libssh/src/string.c	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_pubkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/pki.c	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/match.c	['ssh_client_config_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/auth.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/connector.c	['ssh_client_fuzzer']	[]
/src/libssh/tests/fuzz/ssh_privkey_fuzzer.c	['ssh_privkey_fuzzer']	['ssh_privkey_fuzzer']
/src/libssh/src/libcrypto.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/tests/fuzz/ssh_known_hosts_fuzzer.c	['ssh_known_hosts_fuzzer']	['ssh_known_hosts_fuzzer']
/src/libssh/src/curve25519_crypto.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/error.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/tests/fuzz/ssh_client_config_fuzzer.c	['ssh_client_config_fuzzer']	['ssh_client_config_fuzzer']
/src/libssh/src/gzip.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/init.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
/src/libssh/src/client.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/wrapper.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/poll.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/kex.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/dh.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/log.c	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/ecdh_crypto.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/pki_ed25519_common.c	['ssh_sshsig_fuzzer', 'ssh_client_fuzzer']	['ssh_client_fuzzer']
/src/libssh/src/misc.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/callbacks.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/pki_crypto.c	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/bignum.c	['ssh_sshsig_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_pubkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/packet.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/config_parser.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer']
/src/libssh/src/getrandom_crypto.c	['ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/connect.c	['ssh_client_fuzzer']	[]
/src/libssh/src/crypto_common.c	[]	[]
/src/libssh/src/buffer.c	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_sshsig_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/socket.c	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/messages.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_server_fuzzer']
/src/libssh/src/token.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/config.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer']
/src/libssh/src/base64.c	['ssh_sshsig_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_sshsig_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_known_hosts_fuzzer']
/src/libssh/tests/fuzz/ssh_sshsig_fuzzer.c	['ssh_sshsig_fuzzer']	['ssh_sshsig_fuzzer']
/src/libssh/src/md_crypto.c	['ssh_sshsig_fuzzer', 'ssh_pubkey_fuzzer', 'ssh_privkey_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer', 'ssh_server_fuzzer']	['ssh_client_fuzzer', 'ssh_server_fuzzer']

Directories in report

Directory
/src/libssh/src/external/
/src/libssh/src/threads/
/src/libssh/src/
/src/libssh/tests/fuzz/