High level conclusions

Fuzzers reach 55.26% of cyclomatic complexity.

Fuzzers reach 51.01% of all functions.

Fuzzer fuzz_post_preserve is blocked:

The runtime code coverage of fuzz_post_preserve covers 28.27% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1158 / 2270

Cyclomatic complexity statically reachable by fuzzers

3807 / 6889

Runtime code coverage of functions

967 / 2270

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_base64

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	58	33.9%
gold	[1:9]	99	57.8%
yellow	[10:29]	2	1.16%
greenyellow	[30:49]	4	2.33%
lawngreen	50+	8	4.67%
All colors	171	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
7	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143
2	0	EP	call site: 00000	LLVMFuzzerInitialize
2	96	oidc_cache_mutex_global_create	call site: 00096	oidc_serror
2	99	oidc_cache_mutex_global_create	call site: 00099	oidc_serror
1	7	oidc_pre_config_init	call site: 00007
1	9	oidc_test_setup	call site: 00009

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

65

Reachable functions

98

Percentage of reachable functions covered

33.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_base64.c	7
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	5
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	2
mod_auth_openidcutil/base64.c	8

Fuzzer: fuzz_post_preserve

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	222	55.2%
gold	[1:9]	102	25.3%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	78	19.4%
All colors	402	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	222	_oidc_strnatcasecmp	call site: 00222	_oidc_util_url_cur_port
34	171	oidc_original_request_method	call site: 00171	oidc_util_url_redirect_uri
33	336	oidc_response_post_preserve_javascript	call site: 00336	oidc_util_html_send_in_template
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
18	377	oidc_util_html_javascript_escape	call site: 00377	oidc_util_template_escape
15	206	oidc_http_hdr_in_get	call site: 00206	oidc_util_strcasestr
8	318	oidc_util_read_form_encoded_params_impl	call site: 00318	_oidc_strcmp
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143

Runtime coverage analysis

Covered functions

68

Functions that are reachable but not covered

137

Reachable functions

191

Percentage of reachable functions covered

28.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_post_preserve.c	12
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	20
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	16
mod_auth_openidc/test/fuzz/fuzz.h	2
mod_auth_openidchandle/response.c	17
mod_auth_openidcmod_auth_openidc.c	8
mod_auth_openidcutil/url.c	35
mod_auth_openidcutil/util.c	33
mod_auth_openidc/test/stub.c	4
mod_auth_openidchandle/discovery.c	1
mod_auth_openidcutil/html.c	14
mod_auth_openidcutil/file.c	17
mod_auth_openidcutil/request_state.c	5

Fuzzer: fuzz_form_params

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	32.6%
gold	[1:9]	98	53.2%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	14.1%
All colors	184	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
7	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143
2	96	oidc_cache_mutex_global_create	call site: 00096	oidc_serror
2	99	oidc_cache_mutex_global_create	call site: 00099	oidc_serror
1	0	EP	call site: 00000	LLVMFuzzerInitialize
1	7	oidc_pre_config_init	call site: 00007
1	9	oidc_test_setup	call site: 00009

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

68

Reachable functions

106

Percentage of reachable functions covered

35.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_form_params.c	9
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	5
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	6
mod_auth_openidcutil/util.c	12
mod_auth_openidc/test/stub.c	1

Fuzzer: fuzz_pem_key

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	428	42.0%
gold	[1:9]	121	11.8%
yellow	[10:29]	16	1.57%
greenyellow	[30:49]	3	0.29%
lawngreen	50+	451	44.2%
All colors	1019	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
64	842	lex_scan_string	call site: 00842	lex_scan_number
25	621	do_dump	call site: 00621	jsonp_dtostr
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
17	725	json_object_iter_next	call site: 00725	do_dump
17	822	lex_get_save	call site: 00822	lex_get_save
15	489	seed_from_urandom	call site: 00489	seed_from_windows_cryptoapi
14	377	_oidc_jwk_ec_key_to_jwk	call site: 00377	oidc_jose_error_openssl
14	780	jsonp_error_set_source	call site: 00780	error_set
13	912	jsonp_stringn_nocheck_own	call site: 00912	json_real
11	341	cjose_jwk_create_RSA_spec	call site: 00341	CJOSE_ERROR
7	333	cjose_jwk_create_RSA_spec	call site: 00333
7	572	hashtable_set	call site: 00572	hashtable_do_rehash

Runtime coverage analysis

Covered functions

203

Functions that are reachable but not covered

234

Reachable functions

405

Percentage of reachable functions covered

42.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_pem_key.c	15
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	5
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	21
mod_auth_openidchttp.c	2
mod_auth_openidcutil/base64.c	8
mod_auth_openidcjose/jwk.c	75
mod_auth_openidcjose.c	17
cjosebase64.c	3
cjosejwk.c	41
janssonvalue.c	45
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonutf.c	2
janssonmemory.c	2
janssonjansson.h	5
janssondump.c	38
janssonstrbuffer.c	6
janssonstrconv.c	9
cjoseutil.c	4
janssonload.c	63
janssonerror.c	8
mod_auth_openidcjson.c	5

Fuzzer: fuzz_current_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	69	25.1%
gold	[1:9]	97	35.4%
yellow	[10:29]	1	0.36%
greenyellow	[30:49]	1	0.36%
lawngreen	50+	106	38.6%
All colors	274	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
9	181	oidc_check_x_forwarded_hdr	call site: 00181	oidc_util_spaced_string_to_hashtable
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
5	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143
2	0	EP	call site: 00000	LLVMFuzzerInitialize
2	96	oidc_cache_mutex_global_create	call site: 00096	oidc_serror
2	99	oidc_cache_mutex_global_create	call site: 00099	oidc_serror
1	7	oidc_pre_config_init	call site: 00007

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

82

Reachable functions

143

Percentage of reachable functions covered

42.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_current_url.c	20
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	20
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	6
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	13
mod_auth_openidc/test/fuzz/fuzz.h	2
mod_auth_openidcutil/url.c	29
mod_auth_openidcutil/util.c	7
mod_auth_openidc/test/stub.c	2

Fuzzer: fuzz_jwt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	580	39.1%
gold	[1:9]	215	14.5%
yellow	[10:29]	43	2.90%
greenyellow	[30:49]	13	0.87%
lawngreen	50+	630	42.5%
All colors	1481	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
109	1290	_encode	call site: 01290	oidc_jwk_pkey_to_jwk
53	1231	oidc_jwk_new	call site: 01231	oidc_jwk_pem_bio_read_public
36	1194	oidc_jwk_parse	call site: 01194	_oidc_jwk_parse_x5c_spec
28	898	oidc_jwt_parse	call site: 00898	oidc_jwt_destroy
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
18	994	cjose_jws_verify	call site: 00994	oidc_jwk_parse
15	418	seed_from_urandom	call site: 00418	seed_from_windows_cryptoapi
14	855	json_object_iter_next	call site: 00855	do_dump
10	1421	oidc_jwk_parse	call site: 01421	cjose_jws_verify
9	1059	cjose_jwk_create_EC_spec	call site: 01059	CJOSE_ERROR
8	1409	oidc_jwk_parse	call site: 01409	json_array_get
7	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create

Runtime coverage analysis

Covered functions

292

Functions that are reachable but not covered

166

Reachable functions

367

Percentage of reachable functions covered

54.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_jwt.c	13
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	6
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	2
mod_auth_openidcjose/jws.c	42
mod_auth_openidcjose/jwe.c	22
cjosejwe.c	28
janssonjansson.h	6
janssonvalue.c	58
janssonhashtable.c	21
cjoseutil.c	7
cjosebase64.c	5
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonhashtable_seed.c	25
cjoseheader.c	7
cjosejws.c	22
jansson/test/suites/api/test_fixed_size.c	2
mod_auth_openidcjson.c	6
janssondump.c	38
janssonutf.c	2
mod_auth_openidcjose.c	38
mod_auth_openidc/test/test-cmd.c	18
mod_auth_openidcjose/jwk.c	80
cjosejwk.c	55

Fuzzer: fuzz_jwks

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	290	24.1%
gold	[1:9]	199	16.5%
yellow	[10:29]	22	1.83%
greenyellow	[30:49]	16	1.33%
lawngreen	50+	672	56.0%
All colors	1199	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
46	999	_oidc_jwk_rsa_key_to_jwk	call site: 00999	_oidc_jwk_ec_key_to_jwk
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
15	335	seed_from_urandom	call site: 00335	seed_from_windows_cryptoapi
14	612	json_object_iter_next	call site: 00612	do_dump
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
5	598	do_dump	call site: 00598	json_object_size
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
4	575	dump_indent	call site: 00575	FLAGS_TO_INDENT
4	683	_decode_json_object_base64url_attribute	call site: 00683	_decode
4	929	oidc_jwk_populate_cert_info	call site: 00929	oidc_jose_error_openssl
4	978	_oidc_jwk_rsa_key_to_jwk	call site: 00978	oidc_jose_error_openssl
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached

Runtime coverage analysis

Covered functions

274

Functions that are reachable but not covered

209

Reachable functions

432

Percentage of reachable functions covered

51.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_jwks.c	21
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	5
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	2
mod_auth_openidcjson.c	16
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	46
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	5
mod_auth_openidcjose/jwk.c	96
janssondump.c	38
janssonutf.c	2
cjosejwk.c	63
cjosebase64.c	5
cjoseutil.c	7
mod_auth_openidcjose.c	21

Fuzzer: fuzz_cookie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	293	30.8%
gold	[1:9]	108	11.3%
yellow	[10:29]	5	0.52%
greenyellow	[30:49]	2	0.21%
lawngreen	50+	542	57.0%
All colors	950	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
43	588	_oct_new	call site: 00588	oidc_jwk_set_or_generate_kid
17	878	oidc_util_url_cur_is_secure	call site: 00878	oidc_http_hdr_forwarded_get
15	112	_oidc_str_to_int_checked	call site: 00112	_oidc_metrics_shm_size
15	404	seed_from_urandom	call site: 00404	seed_from_windows_cryptoapi
13	771	oidc_alg2kty	call site: 00771	cjose_jwe_decrypt
13	834	oidc_jose_zlib_uncompress	call site: 00834	oidc_jose_brotli_uncompress
11	717	_cjose_header_validate_crit	call site: 00717	json_array_size
6	753	_cjose_jwe_validate_enc	call site: 00753	cjose_jwe_release
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
5	180	oidc_http_get_cookie	call site: 00180	oidc_util_log_mask_secrets
5	765	oidc_jwe_decrypt_impl	call site: 00765	oidc_jwe_decrypt_by_kid
5	940	oidc_state_cookies_clean_expired	call site: 00940	oidc_http_set_cookie

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

191

Reachable functions

392

Percentage of reachable functions covered

51.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_cookie.c	13
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	37
mod_auth_openidcutil/util.c	6
mod_auth_openidcstate.c	23
mod_auth_openidcproto/state.c	9
mod_auth_openidcutil/jwt.c	12
mod_auth_openidcproto/jwt.c	10
mod_auth_openidcutil/base64.c	8
mod_auth_openidcjson.c	17
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	6
janssonvalue.c	33
janssonhashtable_seed.c	25
janssonhashtable.c	17
janssonjansson.h	2
mod_auth_openidcjose/jwk.c	13
cjosejwk.c	7
mod_auth_openidcjose.c	28
cjosebase64.c	5
mod_auth_openidcjose/jwe.c	22
cjosejwe.c	28
cjoseutil.c	7
cjoseheader.c	7
mod_auth_openidcjose/jws.c	2
mod_auth_openidcutil/url.c	8

Fuzzer: fuzz_bearer_token

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1689	54.8%
gold	[1:9]	137	4.44%
yellow	[10:29]	79	2.56%
greenyellow	[30:49]	24	0.77%
lawngreen	50+	1151	37.3%
All colors	3080	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
209	2478	cjose_jws_verify	call site: 02478	oidc_jwk_parse
204	1413	oidc_oauth_provider_config	call site: 01413	oidc_oauth_metadata_provider_retrieve
138	934	_decode	call site: 00934	_cjose_jwk_import_RSA
124	2699	oidc_jwt_verify	call site: 02699	oidc_proto_jwks_uri_keys
110	1873	oidc_util_base64url_encode	call site: 01873	oidc_json_decode_and_check_error
89	2881	oidc_get_remote_user	call site: 02881	oidc_util_regexp_substitute
75	1795	oidc_oauth_get_cached_access_token	call site: 01795	oidc_oauth_introspect
73	1286	oidc_util_url_redirect_uri	call site: 01286	_oidc_util_url_base_cur
46	2399	oidc_jwt_alg2kty	call site: 02399	oidc_proto_jwks_uri_keys
31	1675	oidc_json_is_true	call site: 01675	oidc_json_object_get_int
30	891	json_loadb	call site: 00891	cjose_jwk_import_json
24	862	cjose_jws_sign	call site: 00862	cjose_jwk_import

Runtime coverage analysis

Covered functions

488

Functions that are reachable but not covered

520

Reachable functions

906

Percentage of reachable functions covered

42.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_bearer_token.c	43
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	27
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	4
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	15
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	13
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	5
mod_auth_openidchttp.c	84
mod_auth_openidc/test/fuzz/fuzz.h	2
mod_auth_openidcjson.c	59
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	62
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	7
mod_auth_openidc/test/fuzz/fuzz_authz_response.c	5
janssonutf.c	2
mod_auth_openidcjose.c	46
mod_auth_openidcjose/jwk.c	97
cjosejwk.c	63
cjosebase64.c	5
mod_auth_openidcjose/jws.c	47
cjosejws.c	30
cjoseutil.c	7
janssondump.c	38
cjoseheader.c	10
mod_auth_openidc/test/test-cmd.c	24
mod_auth_openidcoauth.c	154
mod_auth_openidc/test/stub.c	4
mod_auth_openidcutil/base64.c	12
mod_auth_openidcutil/util.c	51
mod_auth_openidcmod_auth_openidc.c	35
mod_auth_openidcutil/url.c	35
mod_auth_openidchandle/revoke.c	4
mod_auth_openidcmetadata/oauth.c	13
mod_auth_openidcmetadata/util.c	21
mod_auth_openidcproto/profile.c	2
mod_auth_openidcproto/proto.c	6
mod_auth_openidcutil/request_state.c	9
jansson/test/suites/api/test_fixed_size.c	2
mod_auth_openidcproto/auth.c	35
mod_auth_openidcutil/random.c	10
mod_auth_openidcproto/jwt.c	33
mod_auth_openidcjose/jwe.c	22
cjosejwe.c	28
mod_auth_openidcproto/jwks.c	25
mod_auth_openidcmetadata/jwks.c	39
mod_auth_openidcutil/expr.c	8
mod_auth_openidcutil/pcre_subst.c	34
mod_auth_openidcutil/appinfo.c	41

Fuzzer: fuzz_metadata

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	611	41.7%
gold	[1:9]	140	9.56%
yellow	[10:29]	38	2.59%
greenyellow	[30:49]	22	1.50%
lawngreen	50+	652	44.5%
All colors	1463	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
200	1025	_oidc_jwk_parse_x5c_spec	call site: 01025	_oidc_jwk_parse_x5c
191	823	cjose_jwk_import_json	call site: 00823	_cjose_jwk_import_RSA
28	1227	oidc_jwk_parse	call site: 01227	oidc_jose_get_string
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
17	1276	oidc_cfg_provider_signed_jwks_uri_keys_set	call site: 01276	oidc_json_decref
15	337	seed_from_urandom	call site: 00337	seed_from_windows_cryptoapi
14	772	json_object_iter_next	call site: 00772	do_dump
7	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create
6	631	json_integer_value	call site: 00631	oidc_metadata_mtls_endpoint_aliases_get
5	758	do_dump	call site: 00758	json_object_size
5	1019	oidc_jose_get_string	call site: 01019	json_string_value
5	1319	oidc_metadata_get_jwks	call site: 01319	APR_ARRAY_PUSH

Runtime coverage analysis

Covered functions

363

Functions that are reachable but not covered

281

Reachable functions

527

Percentage of reachable functions covered

46.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_metadata.c	15
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	20
mod_auth_openidccfg/provider.c	22
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	7
mod_auth_openidchttp.c	2
mod_auth_openidcjson.c	43
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	41
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	2
mod_auth_openidcmetadata/provider.c	36
mod_auth_openidcutil/util.c	3
mod_auth_openidcmetadata/util.c	28
mod_auth_openidcproto/profile.c	2
mod_auth_openidcjose/jwk.c	88
janssondump.c	38
janssonutf.c	2
cjosejwk.c	55
cjosebase64.c	5
cjoseutil.c	7
mod_auth_openidcjose.c	21
mod_auth_openidcmetadata/conf.c	48
mod_auth_openidcmetadata/client.c	18

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	97	34.6%
gold	[1:9]	105	37.5%
yellow	[10:29]	9	3.21%
greenyellow	[30:49]	2	0.71%
lawngreen	50+	67	23.9%
All colors	280	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
13	202	oidc_util_regexp_first_match	call site: 00202
9	191	oidc_pcre_exec	call site: 00191
6	236	oidc_util_strcasestr	call site: 00236	oidc_http_hdr_in_x_forwarded_host_get
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
5	224	oidc_validate_redirect_url_host	call site: 00224	oidc_http_hdr_forwarded_get
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
4	230	oidc_http_hdr_in_get	call site: 00230	oidc_util_strcasestr
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143
2	96	oidc_cache_mutex_global_create	call site: 00096	oidc_serror

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

93

Reachable functions

143

Percentage of reachable functions covered

34.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_url.c	13
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	6
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	13
mod_auth_openidcmod_auth_openidc.c	23
mod_auth_openidcutil/expr.c	6
mod_auth_openidcutil/pcre_subst.c	17
mod_auth_openidcutil/url.c	6
mod_auth_openidcutil/util.c	1

Fuzzer: fuzz_redirect_uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3973	74.8%
gold	[1:9]	250	4.70%
yellow	[10:29]	125	2.35%
greenyellow	[30:49]	16	0.30%
lawngreen	50+	944	17.7%
All colors	5308	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
481	3282	oidc_jwt_parse	call site: 03282	oidc_proto_jwt_verify
295	3959	oidc_proto_token_endpoint_call	call site: 03959	oidc_userinfo_retrieve_claims
294	2299	oidc_cfg_endpoint_auth_is_mtls	call site: 02299	oidc_cfg_provider_signed_jwks_uri_set
277	4433	oidc_util_hash_string_and_base64url_encode	call site: 04433	oidc_proto_userinfo_request
255	1546	_cjose_jws_validate_hdr	call site: 01546	sign
237	2057	oidc_http_request	call site: 02057	oidc_metadata_provider_parse
177	2933	oidc_util_url_redirect_uri	call site: 02933	oidc_json_decode_and_check_error
145	2668	oidc_util_rand_str	call site: 02668	oidc_metadata_provider_parse
106	5199	oidc_util_read_post_params_impl	call site: 05199	oidc_metadata_list
93	4336	oidc_refresh_token_grant_obtain_tokens	call site: 04336	oidc_refresh_token_grant_apply_id_token
86	4987	oidc_session_get_idtoken	call site: 04987	oidc_session_save
82	3784	oidc_proto_endpoint_client_secret_basic	call site: 03784	oidc_proto_endpoint_auth_client_secret_jwt

Runtime coverage analysis

Covered functions

576

Functions that are reachable but not covered

895

Reachable functions

1331

Percentage of reachable functions covered

32.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c	31
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	25
mod_auth_openidccfg/provider.c	26
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	12
mod_auth_openidcconst.h	8
mod_auth_openidcutil/key.c	13
mod_auth_openidccache/common.c	17
mod_auth_openidcmetrics.c	46
mod_auth_openidccfg/parse.c	7
mod_auth_openidchttp.c	102
mod_auth_openidc/test/fuzz/fuzz.h	2
mod_auth_openidcsession.c	94
mod_auth_openidcjson.c	71
janssonjansson.h	7
janssonvalue.c	74
janssonhashtable.c	21
mod_auth_openidcutil/random.c	11
mod_auth_openidcutil/util.c	63
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonhashtable_seed.c	25
mod_auth_openidcutil/jwt.c	21
mod_auth_openidcproto/jwt.c	36
mod_auth_openidcutil/base64.c	12
mod_auth_openidcjose/jwk.c	102
cjosejwk.c	63
mod_auth_openidcjose.c	48
cjosebase64.c	5
mod_auth_openidcjose/jwe.c	25
cjosejwe.c	46
cjoseutil.c	7
cjoseheader.c	10
mod_auth_openidcjose/jws.c	47
mod_auth_openidcutil/url.c	35
janssonutf.c	2
janssondump.c	38
cjosejws.c	30
mod_auth_openidcutil/request_state.c	6
mod_auth_openidcmod_auth_openidc.c	63
mod_auth_openidc/test/test_handle.c	15
mod_auth_openidc/test/test_proto.c	5
mod_auth_openidc/test/test-cmd.c	24
mod_auth_openidchandle/response.c	120
mod_auth_openidc/test/stub.c	6
mod_auth_openidcstate.c	34
mod_auth_openidcproto/state.c	14
mod_auth_openidcutil/html.c	20
mod_auth_openidcmetadata/provider.c	59
mod_auth_openidcmetadata/util.c	39
mod_auth_openidcproto/profile.c	2
mod_auth_openidcmetadata.c	26
mod_auth_openidcutil/file.c	23
mod_auth_openidcmetadata/conf.c	58
mod_auth_openidcmetadata/client.c	70
mod_auth_openidcproto/proto.c	3
mod_auth_openidcproto/response.c	37
mod_auth_openidcproto/id_token.c	57
jansson/test/suites/api/test_fixed_size.c	2
mod_auth_openidcproto/jwks.c	25
mod_auth_openidcmetadata/jwks.c	39
mod_auth_openidcproto/token.c	53
mod_auth_openidcproto/auth.c	35
mod_auth_openidcproto/dpop.c	23
mod_auth_openidchandle/userinfo.c	24
mod_auth_openidcproto/userinfo.c	74
mod_auth_openidchandle/refresh.c	53
mod_auth_openidcutil/expr.c	11
mod_auth_openidcutil/jq.c	31
mod_auth_openidcutil/pcre_subst.c	34
mod_auth_openidchandle/content.c	20
mod_auth_openidchandle/info.c	44
mod_auth_openidcutil/appinfo.c	14
mod_auth_openidchandle/dpop.c	15
mod_auth_openidchandle/jwks.c	10
mod_auth_openidchandle/discovery.c	30

Fuzzer: fuzz_discovery_response

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2753	71.1%
gold	[1:9]	127	3.28%
yellow	[10:29]	2	0.05%
greenyellow	[30:49]	6	0.15%
lawngreen	50+	980	25.3%
All colors	3868	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
575	2496	oidc_proto_request_auth_params_set	call site: 02496	oidc_proto_request_object_param_add
484	3380	oidc_request_authenticate_user	call site: 03380	oidc_discovery_response_authenticate
172	894	oidc_http_query_encoded_url	call site: 00894	oidc_json_decode_and_check_error
170	3079	oidc_proto_profile_auth_request_method_get	call site: 03079	oidc_proto_request_auth_push
152	1669	_encode	call site: 01669	oidc_jwks_parse_json
82	1566	cjose_jwk_release	call site: 01566	_oidc_jwk_parse_x5c_spec
80	1466	_cjose_cleanse_dealloc	call site: 01466	_cjose_jwk_import_RSA
72	1290	oidc_proto_profile_ops	call site: 01290	oidc_cfg_provider_signed_jwks_uri_set
72	3296	oidc_http_param_is_sensitive	call site: 03296	oidc_util_html_send_in_template
53	1236	oidc_jwk_new	call site: 01236	oidc_metadata_provider_parse
53	1410	_decode	call site: 01410	_decode_json_object_base64url_attribute
47	388	oidc_validate_redirect_url	call site: 00388	oidc_validate_redirect_url_allowed

Runtime coverage analysis

Covered functions

369

Functions that are reachable but not covered

721

Reachable functions

1055

Percentage of reachable functions covered

31.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_discovery_response.c	14
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	25
mod_auth_openidccfg/provider.c	26
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	9
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	7
mod_auth_openidchttp.c	95
mod_auth_openidchandle/discovery.c	52
mod_auth_openidcutil/url.c	35
mod_auth_openidcutil/util.c	41
mod_auth_openidcutil/html.c	17
mod_auth_openidc/test/stub.c	4
mod_auth_openidcmod_auth_openidc.c	46
mod_auth_openidcutil/expr.c	6
mod_auth_openidcutil/pcre_subst.c	17
mod_auth_openidcjson.c	68
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	73
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	7
mod_auth_openidcmetadata/provider.c	59
mod_auth_openidcmetadata/util.c	37
janssondump.c	38
janssonutf.c	2
mod_auth_openidcjose/jwk.c	98
cjosejwk.c	63
mod_auth_openidcproto/profile.c	2
cjosebase64.c	5
cjoseutil.c	7
mod_auth_openidcjose.c	46
mod_auth_openidchandle/request.c	73
mod_auth_openidcutil/request_state.c	6
mod_auth_openidcproto/proto.c	3
mod_auth_openidcutil/random.c	10
mod_auth_openidcutil/base64.c	12
mod_auth_openidcproto/state.c	19
mod_auth_openidcstate.c	34
mod_auth_openidcutil/jwt.c	21
mod_auth_openidcjose/jws.c	47
mod_auth_openidcjose/jwe.c	25
cjosejwe.c	46
cjoseheader.c	10
cjosejws.c	30
mod_auth_openidcproto/jwt.c	21
mod_auth_openidcproto/request.c	55
mod_auth_openidcproto/request_object.c	62
mod_auth_openidc/test/test-cmd.c	24
mod_auth_openidcmetadata/jwks.c	39
jansson/test/suites/api/test_fixed_size.c	2
mod_auth_openidcproto/auth.c	35
mod_auth_openidchandle/response.c	17
mod_auth_openidcutil/file.c	23
mod_auth_openidcproto/discovery.c	25
mod_auth_openidcmetadata.c	9
mod_auth_openidcmetadata/conf.c	58
mod_auth_openidcmetadata/client.c	70

Fuzzer: fuzz_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	113	23.0%
gold	[1:9]	118	24.0%
yellow	[10:29]	16	3.26%
greenyellow	[30:49]	4	0.81%
lawngreen	50+	239	48.7%
All colors	490	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
15	335	seed_from_urandom	call site: 00335	seed_from_windows_cryptoapi
7	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create
7	367	parse_object	call site: 00367	json_object_getn
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143
3	168	jsonp_error_set_source	call site: 00168	error_set
3	302	jsonp_stringn_nocheck_own	call site: 00302	jsonp_strndup
3	331	seed_from_urandom	call site: 00331

Runtime coverage analysis

Covered functions

132

Functions that are reachable but not covered

120

Reachable functions

237

Percentage of reachable functions covered

49.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_json.c	9
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	5
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	2
mod_auth_openidcjson.c	14
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	6
janssonvalue.c	29
janssonhashtable_seed.c	25
janssonhashtable.c	17
janssonjansson.h	2

Fuzzer: fuzz_strings

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	17.0%
gold	[1:9]	121	17.2%
yellow	[10:29]	8	1.13%
greenyellow	[30:49]	4	0.56%
lawngreen	50+	449	63.9%
All colors	702	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
15	434	seed_from_urandom	call site: 00434	seed_from_windows_cryptoapi
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
4	613	oidc_http_hdr_in_get	call site: 00613	oidc_debug
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143
3	267	jsonp_error_set_source	call site: 00267	error_set
3	401	jsonp_stringn_nocheck_own	call site: 00401	jsonp_strndup
3	430	seed_from_urandom	call site: 00430
3	609	oidc_state_browser_fingerprint	call site: 00609	oidc_http_hdr_in_x_forwarded_for_get

Runtime coverage analysis

Covered functions

181

Functions that are reachable but not covered

158

Reachable functions

325

Percentage of reachable functions covered

51.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_strings.c	32
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	7
mod_auth_openidchttp.c	22
mod_auth_openidc/test/fuzz/fuzz.h	2
mod_auth_openidcutil/html.c	5
mod_auth_openidcutil/util.c	22
mod_auth_openidc/test/stub.c	2
mod_auth_openidcproto/jwt.c	10
mod_auth_openidcutil/base64.c	12
mod_auth_openidcjson.c	16
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	6
janssonvalue.c	32
janssonhashtable_seed.c	25
janssonhashtable.c	17
janssonjansson.h	2
mod_auth_openidcstate.c	10
mod_auth_openidcjose.c	12

Fuzzer: fuzz_state_cookie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	323	31.0%
gold	[1:9]	243	23.3%
yellow	[10:29]	44	4.23%
greenyellow	[30:49]	11	1.05%
lawngreen	50+	418	40.2%
All colors	1039	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
43	539	_oct_new	call site: 00539	oidc_jwk_set_or_generate_kid
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
21	994	do_dump	call site: 00994	do_dump
15	355	seed_from_urandom	call site: 00355	seed_from_windows_cryptoapi
15	939	do_dump	call site: 00939	jsonp_dtostr
13	786	oidc_jose_zlib_uncompress	call site: 00786	oidc_jose_brotli_uncompress
13	975	dump_indent	call site: 00975	do_dump
11	668	_cjose_header_validate_crit	call site: 00668	json_array_size
11	880	hashtable_do_del	call site: 00880	json_array_deep_copy
10	722	oidc_alg2kty	call site: 00722	_oidc_strncmp
7	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create
6	704	_cjose_jwe_validate_enc	call site: 00704	cjose_jwe_release

Runtime coverage analysis

Covered functions

249

Functions that are reachable but not covered

182

Reachable functions

408

Percentage of reachable functions covered

55.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_state_cookie.c	23
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	6
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	2
mod_auth_openidcproto/state.c	14
mod_auth_openidcutil/jwt.c	12
mod_auth_openidcproto/jwt.c	10
mod_auth_openidcutil/base64.c	8
mod_auth_openidcjson.c	22
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	68
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	2
mod_auth_openidcjose/jwk.c	13
cjosejwk.c	7
mod_auth_openidcjose.c	28
cjosebase64.c	5
mod_auth_openidcjose/jwe.c	22
cjosejwe.c	28
cjoseutil.c	7
cjoseheader.c	7
mod_auth_openidcjose/jws.c	2
janssonutf.c	2
janssondump.c	38

Fuzzer: fuzz_backchannel_logout

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2816	66.0%
gold	[1:9]	171	4.01%
yellow	[10:29]	95	2.22%
greenyellow	[30:49]	52	1.22%
lawngreen	50+	1128	26.4%
All colors	4262	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
370	3807	oidc_cache_mutex_unlock	call site: 03807	oidc_refresh_token_grant_apply_id_token
287	1821	oidc_cfg_parse_is_valid_url_scheme	call site: 01821	oidc_metadata_provider_parse
225	2182	oidc_jose_get_string	call site: 02182	oidc_jwks_parse_json
172	2728	oidc_util_url_cur_host	call site: 02728	oidc_json_decode_and_check_error
162	2910	oidc_json_array_has_value	call site: 02910	oidc_proto_token_endpoint_auth
138	911	_decode	call site: 00911	_cjose_jwk_import_RSA
123	2599	oidc_proto_profile_id_token_aud_values_get	call site: 02599	oidc_metadata_client_get
116	3468	oidc_proto_validate_iat	call site: 03468	oidc_proto_jwks_uri_keys
114	2484	oidc_util_base64url_encode	call site: 02484	oidc_metadata_provider_parse
75	4181	oidc_util_hash_string_and_base64url_encode	call site: 04181	oidc_json_decode_object
73	2408	oidc_get_provider_for_issuer	call site: 02408	oidc_metadata_get
69	2109	oidc_proto_profile_ops	call site: 02109	oidc_cfg_provider_signed_jwks_uri_set

Runtime coverage analysis

Covered functions

474

Functions that are reachable but not covered

739

Reachable functions

1142

Percentage of reachable functions covered

35.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c	23
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	25
mod_auth_openidccfg/provider.c	26
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	13
mod_auth_openidccache/common.c	17
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	7
mod_auth_openidchttp.c	101
mod_auth_openidc/test/fuzz/fuzz.h	2
mod_auth_openidcjson.c	68
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	74
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	7
mod_auth_openidc/test/fuzz/fuzz_authz_response.c	13
janssonutf.c	2
mod_auth_openidcjose.c	46
mod_auth_openidcjose/jwk.c	102
cjosejwk.c	63
cjosebase64.c	5
mod_auth_openidcjose/jws.c	47
cjosejws.c	30
cjoseutil.c	7
janssondump.c	38
cjoseheader.c	10
mod_auth_openidc/test/test-cmd.c	24
mod_auth_openidcsession.c	91
mod_auth_openidcutil/random.c	11
mod_auth_openidcutil/util.c	50
mod_auth_openidcutil/jwt.c	21
mod_auth_openidcproto/jwt.c	36
mod_auth_openidcutil/base64.c	12
mod_auth_openidcjose/jwe.c	25
cjosejwe.c	46
mod_auth_openidcutil/url.c	29
mod_auth_openidcutil/request_state.c	6
mod_auth_openidchandle/logout.c	108
mod_auth_openidcmod_auth_openidc.c	46
mod_auth_openidcmetadata/provider.c	59
mod_auth_openidcmetadata/util.c	37
mod_auth_openidcproto/profile.c	2
mod_auth_openidcmetadata.c	9
mod_auth_openidcutil/file.c	23
mod_auth_openidcmetadata/conf.c	58
mod_auth_openidcmetadata/client.c	70
mod_auth_openidc/test/stub.c	4
mod_auth_openidcproto/proto.c	3
mod_auth_openidcproto/auth.c	35
mod_auth_openidchandle/response.c	1
mod_auth_openidcutil/html.c	3
jansson/test/suites/api/test_fixed_size.c	2
mod_auth_openidcproto/jwks.c	25
mod_auth_openidcmetadata/jwks.c	39
mod_auth_openidcproto/id_token.c	49
mod_auth_openidcutil/expr.c	9
mod_auth_openidcutil/pcre_subst.c	17
mod_auth_openidchandle/refresh.c	53
mod_auth_openidcproto/token.c	53
mod_auth_openidcproto/dpop.c	23
mod_auth_openidcutil/jq.c	31

Fuzzer: fuzz_response_header

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	56	31.6%
gold	[1:9]	100	56.4%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	21	11.8%
All colors	177	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	106	oidc_cfg_post_config	call site: 00106	_oidc_metrics_shm_size
7	148	oidc_http_curl_pool_init	call site: 00148	oidc_cfg_server_create
5	136	oidc_cfg_parse_option_impl	call site: 00136	oidc_cfg_parse_options_flatten
4	89	oidc_cache_mutex_global_create	call site: 00089	oidc_serror
3	77	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00077	oidc_test_key_derive_cached
3	102	oidc_cache_mutex_global_create	call site: 00102	oidc_serror
3	143	oidc_cfg_dir_parse_pass_userinfo_as	call site: 00143
2	96	oidc_cache_mutex_global_create	call site: 00096	oidc_serror
2	99	oidc_cache_mutex_global_create	call site: 00099	oidc_serror
1	0	EP	call site: 00000	LLVMFuzzerInitialize
1	7	oidc_pre_config_init	call site: 00007
1	9	oidc_test_setup	call site: 00009

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

68

Reachable functions

102

Percentage of reachable functions covered

33.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_response_header.c	9
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	33
mod_auth_openidccfg/cfg.c	15
mod_auth_openidccfg/provider.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	6
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	13
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	4
mod_auth_openidchttp.c	13

Fuzzer: fuzz_authz_response

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2946	61.0%
gold	[1:9]	161	3.33%
yellow	[10:29]	36	0.74%
greenyellow	[30:49]	18	0.37%
lawngreen	50+	1664	34.4%
All colors	4825	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
237	2095	oidc_http_request	call site: 02095	oidc_metadata_provider_parse
223	2408	oidc_jose_get_string	call site: 02408	oidc_jwks_parse_json
186	2632	oidc_get_provider_for_issuer	call site: 02632	oidc_metadata_get
175	4123	oidc_userinfo_retrieve_claims	call site: 04123	oidc_refresh_token_grant
148	1221	_decode	call site: 01221	cjose_jws_sign
116	3531	oidc_proto_validate_iat	call site: 03531	oidc_proto_jwks_uri_keys
100	2969	oidc_util_url_redirect_uri	call site: 02969	oidc_json_decode_object
91	4308	oidc_cache_mutex_unlock	call site: 04308	oidc_proto_token_refresh_request
89	4564	oidc_get_remote_user	call site: 04564	oidc_util_regexp_substitute
82	3821	oidc_proto_endpoint_client_secret_basic	call site: 03821	oidc_proto_endpoint_auth_client_secret_jwt
65	2337	oidc_cfg_endpoint_auth_is_mtls	call site: 02337	oidc_cfg_provider_signed_jwks_uri_set
55	3921	oidc_proto_token_endpoint_dpop_prepare	call site: 03921	oidc_proto_dpop_create

Runtime coverage analysis

Covered functions

616

Functions that are reachable but not covered

713

Reachable functions

1247

Percentage of reachable functions covered

42.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_authz_response.c	68
mod_auth_openidc/test/fuzz/fuzz_url.c	6
mod_auth_openidc/test/util.c	34
mod_auth_openidccfg/cfg.c	25
mod_auth_openidccfg/provider.c	26
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/dir.c	10
mod_auth_openidcconst.h	7
mod_auth_openidcutil/key.c	13
mod_auth_openidccache/common.c	17
mod_auth_openidcmetrics.c	13
mod_auth_openidccfg/parse.c	7
mod_auth_openidchttp.c	101
mod_auth_openidcproto/state.c	19
mod_auth_openidcjson.c	70
janssonvalue.c	74
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	7
janssonutf.c	2
janssonmemory.c	2
mod_auth_openidcstate.c	34
mod_auth_openidcjose.c	48
mod_auth_openidcutil/base64.c	12
mod_auth_openidcutil/jwt.c	21
mod_auth_openidcjose/jwk.c	102
cjosejwk.c	63
cjosebase64.c	5
mod_auth_openidcjose/jws.c	47
mod_auth_openidcjose/jwe.c	25
cjosejwe.c	46
cjoseutil.c	7
cjoseheader.c	10
janssondump.c	38
janssonstrbuffer.c	6
janssonstrconv.c	9
cjosejws.c	30
mod_auth_openidc/test/fuzz/fuzz.h	2
mod_auth_openidcutil/util.c	55
mod_auth_openidc/test/stub.c	4
janssonload.c	63
janssonerror.c	8
mod_auth_openidc/test/test-cmd.c	24
mod_auth_openidcsession.c	91
mod_auth_openidcutil/random.c	11
mod_auth_openidcproto/jwt.c	36
mod_auth_openidcutil/url.c	24
mod_auth_openidcutil/request_state.c	6
mod_auth_openidchandle/response.c	113
mod_auth_openidcutil/html.c	17
mod_auth_openidcmod_auth_openidc.c	28
mod_auth_openidcmetadata/provider.c	59
mod_auth_openidcmetadata/util.c	37
mod_auth_openidcproto/profile.c	2
mod_auth_openidcmetadata.c	9
mod_auth_openidcutil/file.c	23
mod_auth_openidcmetadata/conf.c	58
mod_auth_openidcmetadata/client.c	70
mod_auth_openidcproto/proto.c	3
mod_auth_openidcproto/response.c	37
mod_auth_openidcproto/id_token.c	57
jansson/test/suites/api/test_fixed_size.c	2
mod_auth_openidcproto/jwks.c	25
mod_auth_openidcmetadata/jwks.c	39
mod_auth_openidcproto/token.c	53
mod_auth_openidcproto/auth.c	35
mod_auth_openidcproto/dpop.c	23
mod_auth_openidchandle/userinfo.c	13
mod_auth_openidcproto/userinfo.c	74
mod_auth_openidchandle/refresh.c	53
mod_auth_openidcutil/expr.c	11
mod_auth_openidcutil/jq.c	31
mod_auth_openidcutil/pcre_subst.c	34

Fuzzer: jansson/test/ossfuzz/json_equal_copy_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	29.1%
gold	[1:9]	11	2.40%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	313	68.4%
All colors	457	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	384	LLVMFuzzerTestOneInput	call site: 00384	do_equal
15	174	seed_from_urandom	call site: 00174	seed_from_windows_cryptoapi
15	441	LLVMFuzzerTestOneInput	call site: 00441	json_deep_copy
11	424	json_object_setn_nocheck	call site: 00424	json_array_copy
4	355	hashtable_do_del	call site: 00355	json_array_deep_copy
3	0	EP	call site: 00000	json_loadb
3	7	jsonp_error_set_source	call site: 00007	error_set
3	170	seed_from_urandom	call site: 00170
3	204	parse_object	call site: 00204	json_object_getn
3	361	json_array_size	call site: 00361	do_deep_copy
3	377	json_integer_value	call site: 00377	json_real_copy
2	99	lex_scan_number	call site: 00099	error_set

Runtime coverage analysis

Covered functions

1067

Functions that are reachable but not covered

76

Reachable functions

186

Percentage of reachable functions covered

59.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
jansson/test/ossfuzz/json_equal_copy_fuzzer.cc	11
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	6
janssonvalue.c	76
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	6
jansson/test/suites/api/test_fixed_size.c	2

Fuzzer: jansson/test/ossfuzz/json_load_dump_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	114	24.5%
gold	[1:9]	9	1.93%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	341	73.4%
All colors	464	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	178	seed_from_urandom	call site: 00178	seed_from_windows_cryptoapi
14	427	json_object_iter_next	call site: 00427	do_dump
7	396	json_array_get	call site: 00396	do_dump
5	413	do_dump	call site: 00413	json_object_size
4	459	json_dumps	call site: 00459	json_dump_callback
3	0	EP	call site: 00000	FUZZ_DEBUG
3	11	jsonp_error_set_source	call site: 00011	error_set
3	174	seed_from_urandom	call site: 00174
3	208	parse_object	call site: 00208	json_object_getn
3	326	do_dump	call site: 00326
3	388	dump_indent	call site: 00388	FLAGS_TO_INDENT
2	5	LLVMFuzzerTestOneInput	call site: 00005	json_loadb

Runtime coverage analysis

Covered functions

1067

Functions that are reachable but not covered

72

Reachable functions

182

Percentage of reachable functions covered

60.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
jansson/test/ossfuzz/json_load_dump_fuzzer.cc	8
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	39
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	2
janssondump.c	38
janssonutf.c	2

Fuzzer: jansson/test/ossfuzz/json_pack_unpack_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	266	40.9%
gold	[1:9]	11	1.69%
yellow	[10:29]	2	0.30%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	370	57.0%
All colors	649	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
125	500	LLVMFuzzerTestOneInput	call site: 00500	json_unpack
21	453	do_dump	call site: 00453	do_dump
15	172	seed_from_urandom	call site: 00172	seed_from_windows_cryptoapi
14	629	json_number_value	call site: 00629	next_token
9	438	dump_indent	call site: 00438	do_dump
6	427	json_string_length	call site: 00427	jsonp_loop_check
4	353	hashtable_do_del	call site: 00353	json_array_deep_copy
3	5	jsonp_error_set_source	call site: 00005	error_set
3	168	seed_from_urandom	call site: 00168
3	202	parse_object	call site: 00202	json_object_getn
3	359	json_array_size	call site: 00359	do_deep_copy
3	375	json_integer_value	call site: 00375	json_real_copy

Runtime coverage analysis

Covered functions

1067

Functions that are reachable but not covered

89

Reachable functions

208

Percentage of reachable functions covered

57.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
jansson/test/ossfuzz/json_pack_unpack_fuzzer.cc	14
janssonload.c	63
janssonerror.c	8
janssonstrbuffer.c	6
janssonmemory.c	2
janssonstrconv.c	9
janssonvalue.c	63
janssonhashtable_seed.c	25
janssonhashtable.c	21
janssonjansson.h	3
janssondump.c	38
janssonutf.c	2
janssonpack_unpack.c	49

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
oidc_check_user_id	/src/mod_auth_openidc/src/mod_auth_openidc.c	1	['request_rec*']	30	0	24	5	4	1417	0	3349	104
oidc_post_config	/src/mod_auth_openidc/src/mod_auth_openidc.c	4	['apr_pool_t*', 'apr_pool_t*', 'apr_pool_t*', 'server_rec*']	8	0	30	6	11	128	0	177	91
_cjose_jwe_encrypt_ek_ecdh_es	/src/cjose/src/jwe.c	4	['_jwe_int_recipient_t*', 'cjose_jwe_t*', 'cjose_jwk_t*', 'cjose_err*']	9	0	43	8	13	235	0	660	86
pack_object	/src/jansson/src/pack_unpack.c	2	['scanner_t*', 'va_list*']	15	0	45	10	14	107	23	234	75
oidc_authz_24_checker	/src/mod_auth_openidc/src/handle/authz.c	4	['request_rec*', 'char*', 'void*', 'oidc_authz_match_claim_fn_type']	27	0	15	7	8	900	2	2209	53
pow5mult	/src/jansson/src/dtoa.c	2	['Bigint*', 'int']	4	0	46	16	18	11	0	49	49
oidc_cache_redis_connect	/src/mod_auth_openidc/src/cache/redis.c	2	['request_rec*', 'oidc_cache_cfg_redis_t*']	4	0	24	9	8	30	0	50	43

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1266 / 2270

Cyclomatic complexity statically reachable by fuzzers

4294 / 6889

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

mod_auth_openidc/test/fuzz/fuzz_base64.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_http_curl_pool_init', 'oidc_cfg_parse_option_impl', 'oidc_cache_mutex_global_create', 'oidc_test_crypto_passphrase_derive_keys_cached', 'oidc_cfg_dir_parse_pass_userinfo_as']

mod_auth_openidc/test/fuzz/fuzz_post_preserve.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strnatcasecmp', 'oidc_original_request_method', 'oidc_response_post_preserve_javascript', 'oidc_cfg_post_config', 'oidc_util_html_javascript_escape', 'oidc_http_hdr_in_get', 'oidc_util_read_form_encoded_params_impl', 'oidc_cfg_parse_option_impl', 'oidc_cache_mutex_global_create', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_form_params.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_http_curl_pool_init', 'oidc_cfg_parse_option_impl', 'oidc_cache_mutex_global_create', 'oidc_test_crypto_passphrase_derive_keys_cached', 'oidc_cfg_dir_parse_pass_userinfo_as']

mod_auth_openidc/test/fuzz/fuzz_pem_key.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lex_scan_string', 'do_dump', 'oidc_cfg_post_config', 'json_object_iter_next', 'lex_get_save', 'seed_from_urandom', '_oidc_jwk_ec_key_to_jwk', 'jsonp_error_set_source', 'jsonp_stringn_nocheck_own', 'cjose_jwk_create_RSA_spec']

mod_auth_openidc/test/fuzz/fuzz_current_url.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_check_x_forwarded_hdr', 'oidc_cfg_parse_option_impl', 'oidc_http_curl_pool_init', 'oidc_cache_mutex_global_create', 'oidc_test_crypto_passphrase_derive_keys_cached', 'oidc_cfg_dir_parse_pass_userinfo_as']

mod_auth_openidc/test/fuzz/fuzz_jwt.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_encode', 'oidc_jwk_new', 'oidc_jwk_parse', 'oidc_jwt_parse', 'oidc_cfg_post_config', 'cjose_jws_verify', 'seed_from_urandom', 'json_object_iter_next', 'cjose_jwk_create_EC_spec']

mod_auth_openidc/test/fuzz/fuzz_jwks.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_jwk_rsa_key_to_jwk', 'oidc_cfg_post_config', 'seed_from_urandom', 'json_object_iter_next', 'oidc_cfg_parse_option_impl', 'do_dump', 'oidc_cache_mutex_global_create', 'dump_indent', '_decode_json_object_base64url_attribute', 'oidc_jwk_populate_cert_info']

mod_auth_openidc/test/fuzz/fuzz_cookie.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oct_new', 'oidc_util_url_cur_is_secure', '_oidc_str_to_int_checked', 'seed_from_urandom', 'oidc_alg2kty', 'oidc_jose_zlib_uncompress', '_cjose_header_validate_crit', '_cjose_jwe_validate_enc', 'oidc_cfg_parse_option_impl', 'oidc_http_get_cookie']

mod_auth_openidc/test/fuzz/fuzz_bearer_token.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cjose_jws_verify', 'oidc_oauth_provider_config', '_decode', 'oidc_jwt_verify', 'oidc_util_base64url_encode', 'oidc_get_remote_user', 'oidc_oauth_get_cached_access_token', 'oidc_util_url_redirect_uri', 'oidc_jwt_alg2kty', 'oidc_json_is_true']

mod_auth_openidc/test/fuzz/fuzz_metadata.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_jwk_parse_x5c_spec', 'cjose_jwk_import_json', 'oidc_jwk_parse', 'oidc_cfg_post_config', 'oidc_cfg_provider_signed_jwks_uri_keys_set', 'seed_from_urandom', 'json_object_iter_next', 'oidc_http_curl_pool_init', 'json_integer_value', 'do_dump']

mod_auth_openidc/test/fuzz/fuzz_url.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_util_regexp_first_match', 'oidc_pcre_exec', 'oidc_util_strcasestr', 'oidc_cfg_parse_option_impl', 'oidc_validate_redirect_url_host', 'oidc_cache_mutex_global_create', 'oidc_http_hdr_in_get', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_jwt_parse', 'oidc_proto_token_endpoint_call', 'oidc_cfg_endpoint_auth_is_mtls', 'oidc_util_hash_string_and_base64url_encode', '_cjose_jws_validate_hdr', 'oidc_http_request', 'oidc_util_url_redirect_uri', 'oidc_util_rand_str', 'oidc_util_read_post_params_impl', 'oidc_refresh_token_grant_obtain_tokens']

mod_auth_openidc/test/fuzz/fuzz_discovery_response.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_proto_request_auth_params_set', 'oidc_request_authenticate_user', 'oidc_http_query_encoded_url', 'oidc_proto_profile_auth_request_method_get', '_encode', 'cjose_jwk_release', '_cjose_cleanse_dealloc', 'oidc_proto_profile_ops', 'oidc_http_param_is_sensitive', 'oidc_jwk_new']

mod_auth_openidc/test/fuzz/fuzz_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'seed_from_urandom', 'oidc_http_curl_pool_init', 'parse_object', 'oidc_cfg_parse_option_impl', 'oidc_cache_mutex_global_create', 'oidc_test_crypto_passphrase_derive_keys_cached', 'oidc_cfg_dir_parse_pass_userinfo_as', 'jsonp_error_set_source']

mod_auth_openidc/test/fuzz/fuzz_strings.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'seed_from_urandom', 'oidc_cfg_parse_option_impl', 'oidc_cache_mutex_global_create', 'oidc_http_hdr_in_get', 'oidc_test_crypto_passphrase_derive_keys_cached', 'oidc_cfg_dir_parse_pass_userinfo_as', 'jsonp_error_set_source', 'jsonp_stringn_nocheck_own']

mod_auth_openidc/test/fuzz/fuzz_state_cookie.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oct_new', 'oidc_cfg_post_config', 'do_dump', 'seed_from_urandom', 'oidc_jose_zlib_uncompress', 'dump_indent', '_cjose_header_validate_crit', 'hashtable_do_del', 'oidc_alg2kty']

mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cache_mutex_unlock', 'oidc_cfg_parse_is_valid_url_scheme', 'oidc_jose_get_string', 'oidc_util_url_cur_host', 'oidc_json_array_has_value', '_decode', 'oidc_proto_profile_id_token_aud_values_get', 'oidc_proto_validate_iat', 'oidc_util_base64url_encode', 'oidc_util_hash_string_and_base64url_encode']

mod_auth_openidc/test/fuzz/fuzz_response_header.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_http_curl_pool_init', 'oidc_cfg_parse_option_impl', 'oidc_cache_mutex_global_create', 'oidc_test_crypto_passphrase_derive_keys_cached', 'oidc_cfg_dir_parse_pass_userinfo_as']

mod_auth_openidc/test/fuzz/fuzz_authz_response.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_http_request', 'oidc_jose_get_string', 'oidc_get_provider_for_issuer', 'oidc_userinfo_retrieve_claims', '_decode', 'oidc_proto_validate_iat', 'oidc_util_url_redirect_uri', 'oidc_cache_mutex_unlock', 'oidc_get_remote_user', 'oidc_proto_endpoint_client_secret_basic']

jansson/test/ossfuzz/json_equal_copy_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'seed_from_urandom', 'json_object_setn_nocheck', 'hashtable_do_del', 'jsonp_error_set_source', 'parse_object', 'json_array_size']

jansson/test/ossfuzz/json_load_dump_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['seed_from_urandom', 'json_object_iter_next', 'json_array_get', 'do_dump', 'json_dumps', 'jsonp_error_set_source', 'parse_object']

jansson/test/ossfuzz/json_pack_unpack_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'do_dump', 'seed_from_urandom', 'json_number_value', 'dump_indent', 'json_string_length', 'hashtable_do_del', 'jsonp_error_set_source', 'parse_object']