High level conclusions

Fuzzers reach 50.70% code coverage.

Fuzzers reach 60.34% of cyclomatic complexity.

Fuzzers reach 56.02% of all functions.

Fuzzer ssh_bind_config_fuzzer is blocked:

The runtime code coverage of ssh_bind_config_fuzzer covers 16.85% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ssh_client_config_fuzzer is blocked:

The runtime code coverage of ssh_client_config_fuzzer covers 28.61% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ssh_sshsig_fuzzer_nalloc is blocked:

The runtime code coverage of ssh_sshsig_fuzzer_nalloc covers 28.74% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ssh_privkey_fuzzer_nalloc is blocked:

The runtime code coverage of ssh_privkey_fuzzer_nalloc covers 9.032% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

558 / 996

Cyclomatic complexity statically reachable by fuzzers

4987 / 8264

Runtime code coverage of functions

505 / 996

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: ssh_privkey_fuzzer_nalloc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	489	94.9%
gold	[1:9]	4	0.77%
yellow	[10:29]	1	0.19%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	21	4.07%
All colors	515	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	58	realloc	call site: 00058	ssh_pki_import_pubkey_blob
19	494	pki_private_key_from_base64	call site: 00494	ssh_key_free
18	8	_ssh_log	call site: 00008	ssh_vlog
14	27	ssh_pki_import_privkey_base64	call site: 00027	ssh_pki_openssh_privkey_import
6	49	calloc	call site: 00049	ssh_buffer_allocate_size
3	485	pki_private_key_from_base64	call site: 00485	pem_get_password
2	46	nalloc_fail	call site: 00046	fprintf
1	56	realloc	call site: 00056	__errno_location
1	489	pki_private_key_from_base64	call site: 00489	PEM_read_bio_PrivateKey

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

141

Reachable functions

155

Percentage of reachable functions covered

9.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_privkey_fuzzer.c	1
tests/fuzz/nallocinc.c	7
src/base64.c	6
src/pki.c	11
src/log.c	9
src/pki_container_openssh.c	4
src/buffer.c	19
src/string.c	7
src/bignum.c	1
src/pki_crypto.c	12
src/libcrypto.c	1
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	3
src/external/blowfish.c	6
src/wrapper.c	1

Fuzzer: ssh_sshsig_fuzzer_nalloc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	362	68.3%
gold	[1:9]	39	7.35%
yellow	[10:29]	7	1.32%
greenyellow	[30:49]	39	7.35%
lawngreen	50+	83	15.6%
All colors	530	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	296	sshsig_verify	call site: 00296	ssh_pki_import_signature_blob
53	211	pki_import_pubkey_buffer	call site: 00211	pki_pubkey_build_ed25519
18	7	_ssh_log	call site: 00007	ssh_vlog
18	173	ssh_pki_import_pubkey_blob	call site: 00173	pki_import_cert_buffer
16	268	pki_key_clean	call site: 00268	pki_import_pubkey_buffer
6	126	ssh_buffer_unpack_va	call site: 00126	_ssh_log
4	100	ssh_buffer_unpack_va	call site: 00100	ssh_buffer_get_ssh_string
2	53	ssh_buffer_new	call site: 00053	buffer_shift
2	92	ssh_buffer_unpack_va	call site: 00092	ssh_buffer_get_u8
2	95	ssh_buffer_get_data	call site: 00095	ssh_buffer_get_data
2	133	ssh_buffer_unpack_va	call site: 00133	explicit_bzero
2	202	pki_pubkey_build_rsa	call site: 00202	EVP_PKEY_free

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

119

Reachable functions

167

Percentage of reachable functions covered

28.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_sshsig_fuzzer.c	1
tests/fuzz/nallocinc.c	7
src/pki.c	20
src/log.c	9
src/base64.c	4
src/buffer.c	27
src/string.c	9
src/bignum.c	4
src/pki_crypto.c	11
src/md_crypto.c	8
src/pki_ed25519_common.c	1

Fuzzer: ssh_known_hosts_fuzzer_nalloc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	32.8%
gold	[1:9]	18	4.41%
yellow	[10:29]	3	0.73%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	253	62.0%
All colors	408	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	283	pki_import_pubkey_buffer	call site: 00283	pki_pubkey_build_ed25519
18	16	_ssh_log	call site: 00016	ssh_vlog
13	220	ssh_buffer_unpack_va	call site: 00220	_ssh_log
13	343	ssh_key_cmp	call site: 00343	ssh_string_cmp
11	201	ssh_buffer_unpack_va	call site: 00201	ssh_buffer_get_ssh_string
8	313	ssh_key_clean	call site: 00313	pki_import_pubkey_buffer
6	103	hmac_init	call site: 00103	EVP_sha256
4	322	pki_import_cert_buffer	call site: 00322	pki_import_pubkey_buffer
4	366	pki_key_compare	call site: 00366	EC_KEY_get0_private_key
3	234	ssh_buffer_unpack_va	call site: 00234	strlen
2	66	ssh_buffer_new	call site: 00066	buffer_shift
2	245	pki_pubkey_build_rsa	call site: 00245	EVP_PKEY_free

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

88

Reachable functions

172

Percentage of reachable functions covered

48.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_known_hosts_fuzzer.c	1
tests/fuzz/nallocinc.c	7
src/knownhosts.c	7
src/misc.c	8
src/log.c	9
src/base64.c	4
src/buffer.c	19
src/libcrypto.c	4
src/match.c	3
src/pki.c	11
src/string.c	8
src/bignum.c	1
src/pki_crypto.c	6
src/init.c	2
src/threads/pthread.c	2
src/dh.c	1
src/socket.c	1
src/poll.c	1
src/threads.c	1
src/threads/libcrypto.c	1

Fuzzer: ssh_pubkey_fuzzer_nalloc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	438	68.1%
gold	[1:9]	78	12.1%
yellow	[10:29]	28	4.35%
greenyellow	[30:49]	11	1.71%
lawngreen	50+	88	13.6%
All colors	643	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
205	306	pki_import_cert_buffer	call site: 00306	pki_openssh_import_privkey_blob
103	525	pki_private_key_from_base64	call site: 00525	ssh_pki_export_privkey_to_pubkey
23	241	pki_import_pubkey_buffer	call site: 00241	pki_pubkey_build_ecdsa
18	27	_ssh_log	call site: 00027	ssh_vlog
14	160	ssh_pki_openssh_import	call site: 00160	ssh_pki_import_pubkey_blob
7	219	pki_pubkey_build_rsa	call site: 00219	ssh_make_string_bn
6	47	ssh_pki_import_pubkey_file	call site: 00047	_ssh_log
4	120	ssh_buffer_unpack_va	call site: 00120	ssh_buffer_get_ssh_string
4	148	ssh_buffer_unpack_va	call site: 00148	_ssh_log
4	282	pki_import_pubkey_buffer	call site: 00282	_ssh_log
4	297	ssh_key_clean	call site: 00297	pki_import_pubkey_buffer
4	516	pki_private_key_from_base64	call site: 00516	pem_get_password

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

123

Reachable functions

179

Percentage of reachable functions covered

31.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_pubkey_fuzzer.c	1
src/misc.c	2
tests/fuzz/nallocinc.c	8
src/pki.c	15
src/log.c	9
src/pki_container_openssh.c	4
src/base64.c	4
src/buffer.c	19
src/string.c	8
src/bignum.c	1
src/pki_crypto.c	13
src/libcrypto.c	1
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	3
src/external/blowfish.c	6
src/wrapper.c	1

Fuzzer: ssh_client_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	335	44.1%
gold	[1:9]	79	10.4%
yellow	[10:29]	46	6.06%
greenyellow	[30:49]	23	3.03%
lawngreen	50+	275	36.2%
All colors	758	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	290	ssh_options_set	call site: 00290	_ssh_set_error_invalid
20	90	_ssh_log	call site: 00090	_ssh_log
14	159	ssh_free	call site: 00159	ssh_message_free
14	557	ssh_config_parse_line	call site: 00557	get_address_family
14	582	match_cidr_address_list	call site: 00582	get_address_family
13	76	ssh_socket_close	call site: 00076	ssh_poll_free
13	120	crypto_free	call site: 00120	ssh_key_clean
13	597	ssh_config_parse_line	call site: 00597	ssh_match_localnetwork
12	428	ssh_options_set	call site: 00428	_ssh_set_error_invalid
11	736	ssh_config_parse_line	call site: 00736	ssh_options_set
10	691	ssh_config_parse_line	call site: 00691	ssh_options_set
8	59	ssh_free	call site: 00059	ssh_channel_do_free

Runtime coverage analysis

Covered functions

105

Functions that are reachable but not covered

217

Reachable functions

304

Percentage of reachable functions covered

28.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_client_config_fuzzer.c	1
tests/fuzz/nallocinc.c	7
src/session.c	3
src/wrapper.c	4
src/socket.c	4
src/error.c	3
src/buffer.c	5
src/misc.c	21
src/agent.c	3
src/channels.c	1
src/pcap.c	1
src/poll.c	5
src/log.c	12
src/pki.c	2
src/pki_crypto.c	1
src/string.c	4
src/dh_crypto.c	1
src/gzip.c	1
src/messages.c	1
src/auth.c	2
src/callbacks.c	1
src/options.c	2
src/config_parser.c	6
src/kex.c	6
src/token.c	7
src/config.c	11
src/match.c	8

Fuzzer: ssh_bind_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	604	75.0%
gold	[1:9]	20	2.48%
yellow	[10:29]	19	2.36%
greenyellow	[30:49]	4	0.49%
lawngreen	50+	158	19.6%
All colors	805	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
455	102	realloc	call site: 00102	ssh_pki_import_pubkey_blob
44	563	ssh_pki_import_privkey_file	call site: 00563	ssh_pki_import_privkey_base64
24	75	ssh_bind_config_parse_line	call site: 00075	ssh_pki_import_privkey_base64
17	709	ssh_bind_options_set	call site: 00709	_ssh_set_error_invalid
10	616	ssh_bind_options_set	call site: 00616	_ssh_log
6	7	calloc	call site: 00007	nalloc_backtrace_exclude
5	729	ssh_bind_options_set	call site: 00729	_ssh_set_error_invalid
3	21	ssh_log_function	call site: 00021	ssh_log_custom
3	792	ssh_bind_config_parse_line	call site: 00792	_ssh_log
2	30	current_timestring	call site: 00030	strftime
2	33	ssh_log_stderr	call site: 00033	fprintf
2	48	ssh_bind_config_parse_line	call site: 00048	_ssh_set_error_oom

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

222

Reachable functions

267

Percentage of reachable functions covered

16.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_bind_config_fuzzer.c	1
tests/fuzz/nallocinc.c	7
src/bind.c	2
src/bind_config.c	6
src/log.c	10
src/error.c	3
src/config_parser.c	3
src/options.c	5
src/pki.c	14
src/pki_container_openssh.c	4
src/base64.c	4
src/buffer.c	19
src/string.c	7
src/bignum.c	1
src/pki_crypto.c	14
src/libcrypto.c	1
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	3
src/external/blowfish.c	6
src/wrapper.c	1
src/misc.c	3
src/kex.c	6
src/token.c	7

Fuzzer: ssh_client_fuzzer_nalloc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2639	78.9%
gold	[1:9]	52	1.55%
yellow	[10:29]	168	5.02%
greenyellow	[30:49]	44	1.31%
lawngreen	50+	440	13.1%
All colors	3343	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
400	2289	ssh_pki_import_pubkey_blob	call site: 02289	ssh_userauth_try_publickey
249	2713	ssh_key_size_allowed_rsa	call site: 02713	ssh_userauth_agent_publickey
243	2984	ssh_signature_free	call site: 02984	ssh_event_add_connector
154	1234	ssh_string_get_char	call site: 01234	ssh_userauth_publickey_auto
138	541	ssh_path_expand_escape	call site: 00541	ssh_config_parse_file
132	2136	ssh_client_curve25519_init	call site: 02136	atomicio
121	681	ssh_lowercase	call site: 00681	ssh_config_parse
77	903	ssh_connect	call site: 00903	ssh_socket_connect_proxyjump
75	409	ssh_options_set	call site: 00409	ssh_options_set
72	3254	ssh_disconnect	call site: 03254	select_loop
52	1620	packet_send2	call site: 01620	ssh_pcap_context_write
47	1077	ssh_buffer_add_data	call site: 01077	base64_to_bin

Runtime coverage analysis

Covered functions

294

Functions that are reachable but not covered

472

Reachable functions

698

Percentage of reachable functions covered

32.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_client_fuzzer.c	2
tests/fuzz/nallocinc.c	11
src/session.c	9
src/wrapper.c	10
src/socket.c	23
src/error.c	4
src/buffer.c	31
src/misc.c	28
src/agent.c	11
src/channels.c	31
src/pcap.c	5
src/poll.c	26
src/log.c	13
src/pki.c	43
src/pki_crypto.c	22
src/string.c	12
src/dh_crypto.c	6
src/gzip.c	4
src/messages.c	1
src/auth.c	13
src/callbacks.c	6
src/options.c	4
src/config_parser.c	6
src/kex.c	18
src/token.c	7
src/config.c	12
src/client.c	7
src/init.c	1
src/threads/pthread.c	2
src/match.c	9
src/threads.c	1
src/connect.c	4
src/knownhosts.c	14
src/dh.c	4
src/base64.c	6
src/libcrypto.c	6
src/bignum.c	4
src/packet.c	10
src/getrandom_crypto.c	1
src/server.c	1
src/packet_crypt.c	1
src/md_crypto.c	20
src/kdf.c	5
src/dh-gex.c	1
src/ecdh_crypto.c	3
src/curve25519.c	1
src/curve25519_crypto.c	1
src/sntrup761.c	4
src/external/sntrup761.c	24
src/pki_container_openssh.c	5
src/external/bcrypt_pbkdf.c	2
src/external/blowfish.c	6
src/pki_ed25519_common.c	1
src/connector.c	17

Fuzzer: ssh_server_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1467	64.2%
gold	[1:9]	19	0.83%
yellow	[10:29]	24	1.05%
greenyellow	[30:49]	9	0.39%
lawngreen	50+	764	33.4%
All colors	2283	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
334	1350	ssh_list_prepend	call site: 01350	ssh_send_kex
168	479	sha512_final	call site: 00479	pki_openssh_import_privkey_blob
86	1263	ssh_packet_send	call site: 01263	ssh_send_rekex
38	1131	ssh_buffer_pack_va	call site: 01131	_ssh_buffer_pack
31	1023	pki_key_dup	call site: 01023	ssh_key_free
29	784	ssh_find_all_matching	call site: 00784	ssh_prefix_default_algos
29	828	ssh_bind_options_set	call site: 00828	ssh_bind_set_algo
25	445	ssh_pki_import_pubkey_blob	call site: 00445	pki_private_key_decrypt
25	1712	packet_send2	call site: 01712	compress_buffer
23	1999	cipher_new	call site: 01999	_ssh_log
22	226	ssh_pki_import_privkey_base64	call site: 00226	ssh_pki_openssh_privkey_import
21	1802	pki_key_to_blob	call site: 01802	ssh_buffer_add_ssh_string

Runtime coverage analysis

Covered functions

394

Functions that are reachable but not covered

284

Reachable functions

525

Percentage of reachable functions covered

45.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/ssh_server_fuzzer.c	2
tests/fuzz/nallocinc.c	11
src/bind.c	4
src/session.c	7
src/wrapper.c	10
src/socket.c	16
src/error.c	3
src/buffer.c	31
src/misc.c	28
src/agent.c	3
src/channels.c	1
src/pcap.c	5
src/poll.c	21
src/log.c	12
src/pki.c	22
src/pki_crypto.c	18
src/string.c	11
src/dh_crypto.c	6
src/gzip.c	4
src/messages.c	1
src/auth.c	2
src/callbacks.c	2
src/options.c	7
src/pki_container_openssh.c	4
src/base64.c	4
src/bignum.c	4
src/libcrypto.c	7
src/external/bcrypt_pbkdf.c	2
src/md_crypto.c	20
src/external/blowfish.c	6
src/kex.c	18
src/token.c	7
src/server.c	4
src/client.c	3
src/getrandom_crypto.c	1
src/packet.c	10
src/knownhosts.c	10
src/config_parser.c	1
src/config.c	1
src/match.c	3
src/packet_crypt.c	1
src/dh.c	3
src/kdf.c	5
src/dh-gex.c	1
src/ecdh_crypto.c	3
src/curve25519.c	1
src/curve25519_crypto.c	1
src/sntrup761.c	4
src/external/sntrup761.c	24

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
ssh_packet_userauth_request	/src/libssh/src/messages.c	4	['N/A', 'char', 'N/A', 'N/A']	35	0	898	187	54	460	0	3073	297
ssh_packet_socket_callback	/src/libssh/src/packet.c	3	['N/A', 'size_t', 'N/A']	27	0	992	133	47	415	1	2725	241
ssh_channel_request_pty	/src/libssh/src/channels.c	1	['N/A']	26	0	15	3	2	439	0	2792	163
ssh_server_connection_callback	/src/libssh/src/server.c	1	['N/A']	29	0	491	85	25	423	0	2659	160
ssh_packet_server_sntrup761x25519_init	/src/libssh/src/sntrup761.c	4	['N/A', 'char', 'N/A', 'N/A']	28	0	398	64	24	460	0	2889	143
ssh_packet_server_dhgex_request	/src/libssh/src/dh-gex.c	4	['N/A', 'char', 'N/A', 'N/A']	18	0	284	51	18	408	0	2571	97
ssh_pki_export_privkey_file	/src/libssh/src/pki.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	14	0	27	3	2	127	0	588	89
channel_rcv_request	/src/libssh/src/channels.c	4	['N/A', 'char', 'N/A', 'N/A']	23	0	746	137	43	426	0	2769	69
ssh_channel_select	/src/libssh/src/channels.c	4	['N/A', 'N/A', 'N/A', 'N/A']	13	0	642	137	40	98	0	445	67
ssh_packet_kexinit	/src/libssh/src/kex.c	4	['N/A', 'char', 'N/A', 'N/A']	16	0	953	164	54	221	0	1467	67

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

678 / 996

Cyclomatic complexity statically reachable by fuzzers

6291 / 8264

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzz/ssh_privkey_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['realloc', 'pki_private_key_from_base64', '_ssh_log', 'ssh_pki_import_privkey_base64', 'calloc', 'nalloc_fail']

tests/fuzz/ssh_sshsig_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshsig_verify', 'pki_import_pubkey_buffer', '_ssh_log', 'ssh_pki_import_pubkey_blob', 'pki_key_clean', 'ssh_buffer_unpack_va', 'ssh_buffer_new', 'ssh_buffer_get_data']

tests/fuzz/ssh_known_hosts_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pki_import_pubkey_buffer', '_ssh_log', 'ssh_buffer_unpack_va', 'ssh_key_cmp', 'ssh_key_clean', 'hmac_init', 'pki_import_cert_buffer', 'pki_key_compare']

tests/fuzz/ssh_pubkey_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pki_import_cert_buffer', 'pki_private_key_from_base64', 'pki_import_pubkey_buffer', '_ssh_log', 'ssh_pki_openssh_import', 'pki_pubkey_build_rsa', 'ssh_pki_import_pubkey_file', 'ssh_buffer_unpack_va']

tests/fuzz/ssh_client_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_options_set', '_ssh_log', 'ssh_free', 'ssh_config_parse_line', 'match_cidr_address_list', 'ssh_socket_close', 'crypto_free']

tests/fuzz/ssh_bind_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['realloc', 'ssh_pki_import_privkey_file', 'ssh_bind_config_parse_line', 'ssh_bind_options_set', 'calloc', 'ssh_log_function', 'current_timestring']

tests/fuzz/ssh_client_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_pki_import_pubkey_blob', 'ssh_key_size_allowed_rsa', 'ssh_signature_free', 'ssh_string_get_char', 'ssh_path_expand_escape', 'ssh_client_curve25519_init', 'ssh_lowercase', 'ssh_connect', 'ssh_options_set', 'ssh_disconnect']

tests/fuzz/ssh_server_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_list_prepend', 'sha512_final', 'ssh_packet_send', 'ssh_buffer_pack_va', 'pki_key_dup', 'ssh_find_all_matching', 'ssh_bind_options_set', 'ssh_pki_import_pubkey_blob', 'packet_send2', 'cipher_new']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ssh_dh_init	36	19	52.77%	['ssh_sshsig_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_server_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_privkey_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']
pki_private_key_from_base64	77	40	51.94%	['ssh_bind_config_fuzzer', 'ssh_server_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer_nalloc', 'ssh_privkey_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']
hmac_init	37	17	45.94%	['ssh_client_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_key_cmp	47	11	23.40%	['ssh_client_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_pki_openssh_import	135	67	49.62%	['ssh_bind_config_fuzzer', 'ssh_server_fuzzer', 'ssh_client_config_fuzzer', 'ssh_pubkey_fuzzer_nalloc', 'ssh_privkey_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']
ssh_config_parse_proxy_jump	119	65	54.62%	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_server_fuzzer']
ssh_config_make_absolute	41	19	46.34%	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_bind_config_fuzzer']
match_cidr_address_list	168	54	32.14%	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_bind_config_fuzzer']
ssh_options_set	692	321	46.38%	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_server_fuzzer']
ssh_socket_close	33	15	45.45%	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_pki_import_privkey_file	62	32	51.61%	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_server_fuzzer']
ssh_channel_free	38	5	13.15%	['ssh_client_fuzzer_nalloc']
dh_handshake	60	32	53.33%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_connect	121	55	45.45%	['ssh_client_fuzzer_nalloc']
ssh_curve25519_init	50	25	50.0%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_packet_client_ecdh_reply	45	18	40.0%	['ssh_client_fuzzer_nalloc']
sshkdf_derive_key	73	25	34.24%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_mac_ctx_init	35	19	54.28%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_client_select_hostkeys	70	27	38.57%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_send_kex	89	48	53.93%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_hashbufout_add_cookie	31	17	54.83%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
revert_kex_callbacks	36	5	13.88%	['ssh_client_fuzzer_nalloc']
ssh_known_hosts_get_algorithms_names	75	25	33.33%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_options_apply	121	53	43.80%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_packet_send	62	24	38.70%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_packet_encrypt	90	37	41.11%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_key_signature_to_char	33	16	48.48%	['ssh_client_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_server_fuzzer']
pki_key_to_blob	335	126	37.61%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_bind_accept_fd	112	39	34.82%	['ssh_server_fuzzer']
ssh_channel_new	44	22	50.0%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
channel_default_bufferize	45	18	40.0%	['ssh_server_fuzzer']
ssh_retrieve_dhgroup	52	16	30.76%	['ssh_server_fuzzer']
ssh_message_queue	35	18	51.42%	['ssh_server_fuzzer']
ssh_execute_server_request	230	80	34.78%	['ssh_server_fuzzer']
ssh_msg_userauth_build_digest	53	28	52.83%	['ssh_server_fuzzer']
pki_key_dup_common_init	37	15	40.54%	['ssh_client_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_pki_export_signature_blob	54	26	48.14%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
pki_key_dup	221	59	26.69%	['ssh_client_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_server_fuzzer']
pki_sign_data	81	43	53.08%	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
ssh_get_key_params	44	20	45.45%	['ssh_server_fuzzer']
ssh_auth_reply_default	44	12	27.27%	['ssh_server_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libssh/src/threads.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']
/src/libssh/src/pki_crypto.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/messages.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_server_fuzzer']
/src/libssh/src/crypto_common.c	[]	[]
/src/libssh/src/socket.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/external/bcrypt_pbkdf.c	['ssh_privkey_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	[]
/src/libssh/src/threads/pthread.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']
/src/libssh/src/pcap.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	[]
/src/libssh/src/callbacks.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/tests/fuzz/ssh_client_fuzzer.c	['ssh_client_fuzzer_nalloc']	['ssh_client_fuzzer_nalloc']
/src/libssh/src/agent.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/kdf.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/wrapper.c	['ssh_privkey_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/misc.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/poll.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/dh.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/knownhosts.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']
/src/libssh/tests/fuzz/nallocinc.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/options.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/pki_ed25519_common.c	['ssh_sshsig_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']	[]
/src/libssh/src/dh_crypto.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/connect.c	['ssh_client_fuzzer_nalloc']	[]
/src/libssh/src/log.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/match.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/ecdh_crypto.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/tests/fuzz/ssh_pubkey_fuzzer.c	['ssh_pubkey_fuzzer_nalloc']	['ssh_pubkey_fuzzer_nalloc']
/src/libssh/tests/fuzz/ssh_server_fuzzer.c	['ssh_server_fuzzer']	['ssh_server_fuzzer']
/src/libssh/src/dh-gex.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/bignum.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/bind.c	['ssh_bind_config_fuzzer', 'ssh_server_fuzzer']	['ssh_bind_config_fuzzer', 'ssh_server_fuzzer']
/src/libssh/src/server.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/auth.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/pki_container_openssh.c	['ssh_privkey_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_pubkey_fuzzer_nalloc']
/src/libssh/src/libcrypto.c	['ssh_privkey_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_privkey_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/string.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/kex.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/config_parser.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc']
/src/libssh/src/error.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/client.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/ttyopts.c	[]	[]
/src/libssh/tests/fuzz/ssh_sshsig_fuzzer.c	['ssh_sshsig_fuzzer_nalloc']	['ssh_sshsig_fuzzer_nalloc']
/src/libssh/src/init.c	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']	['ssh_known_hosts_fuzzer_nalloc', 'ssh_client_fuzzer_nalloc']
/src/libssh/src/curve25519.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/sntrup761.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_server_fuzzer']
/src/libssh/src/packet_cb.c	[]	[]
/src/libssh/src/curve25519_crypto.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/external/sntrup761.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_server_fuzzer']
/src/libssh/src/config.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer']
/src/libssh/tests/fuzz/ssh_client_config_fuzzer.c	['ssh_client_config_fuzzer']	['ssh_client_config_fuzzer']
/src/libssh/src/buffer.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/external/blowfish.c	['ssh_privkey_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	[]
/src/libssh/src/bind_config.c	['ssh_bind_config_fuzzer']	['ssh_bind_config_fuzzer']
/src/libssh/tests/fuzz/ssh_known_hosts_fuzzer.c	['ssh_known_hosts_fuzzer_nalloc']	['ssh_known_hosts_fuzzer_nalloc']
/src/libssh/src/md_crypto.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/packet.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/packet_crypt.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/pki.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/ecdh.c	[]	[]
/src/libssh/src/getrandom_crypto.c	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/channels.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/connector.c	['ssh_client_fuzzer_nalloc']	[]
/src/libssh/tests/fuzz/ssh_bind_config_fuzzer.c	['ssh_bind_config_fuzzer']	['ssh_bind_config_fuzzer']
/src/libssh/src/gzip.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/token.c	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/tests/fuzz/ssh_privkey_fuzzer.c	['ssh_privkey_fuzzer_nalloc']	['ssh_privkey_fuzzer_nalloc']
/src/libssh/src/session.c	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_client_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']
/src/libssh/src/threads/libcrypto.c	['ssh_known_hosts_fuzzer_nalloc']	['ssh_known_hosts_fuzzer_nalloc']
/src/libssh/src/base64.c	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc', 'ssh_bind_config_fuzzer', 'ssh_client_fuzzer_nalloc', 'ssh_server_fuzzer']	['ssh_privkey_fuzzer_nalloc', 'ssh_sshsig_fuzzer_nalloc', 'ssh_known_hosts_fuzzer_nalloc', 'ssh_pubkey_fuzzer_nalloc']

Directories in report

Directory
/src/libssh/src/threads/
/src/libssh/src/external/
/src/libssh/src/
/src/libssh/tests/fuzz/