High level conclusions

Fuzzers reach 52.23% code coverage.

Fuzzers reach 71.53% of cyclomatic complexity.

Fuzzers reach 67.00% of all functions.

Fuzzer fuzz_redirect_uri is blocked:

The runtime code coverage of fuzz_redirect_uri covers 28.75% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_discovery_response is blocked:

The runtime code coverage of fuzz_discovery_response covers 23.00% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_base64 is blocked:

The runtime code coverage of fuzz_base64 covers 22.02% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_backchannel_logout is blocked:

The runtime code coverage of fuzz_backchannel_logout covers 28.90% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_response_header is blocked:

The runtime code coverage of fuzz_response_header covers 22.42% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_form_params is blocked:

The runtime code coverage of fuzz_form_params covers 24.13% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_post_preserve is blocked:

The runtime code coverage of fuzz_post_preserve covers 23.52% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_json is blocked:

The runtime code coverage of fuzz_json covers 25.59% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_url is blocked:

The runtime code coverage of fuzz_url covers 26.86% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1184 / 1767

Cyclomatic complexity statically reachable by fuzzers

10078 / 14089

Runtime code coverage of functions

923 / 1767

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	290	61.7%
gold	[1:9]	104	22.1%
yellow	[10:29]	9	1.91%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	67	14.2%
All colors	470	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
100	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
88	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
9	399	oidc_util_regexp_first_match	call site: 00399	pcre2_substring_get_bynumber_8
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
6	429	oidc_util_strcasestr	call site: 00429	oidc_http_hdr_in_x_forwarded_host_get
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
5	417	oidc_validate_redirect_url_host	call site: 00417	oidc_http_hdr_forwarded_get
5	423	oidc_http_hdr_in_get	call site: 00423	oidc_util_strcasestr
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

147

Reachable functions

201

Percentage of reachable functions covered

26.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_url.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	11
mod_auth_openidc/test/stub.c	5
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	10
/usr/include/jansson.h	2
mod_auth_openidchttp.c	8
mod_auth_openidcmod_auth_openidc.c	6
mod_auth_openidcutil/expr.c	1
mod_auth_openidcutil/pcre_subst.c	4
mod_auth_openidcutil/url.c	1
mod_auth_openidcutil/util.c	1

Fuzzer: fuzz_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	249	67.1%
gold	[1:9]	104	28.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	18	4.85%
All colors	371	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
73	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
59	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
26	302	oidc_json_decref	call site: 00302	_oidc_metrics_storage_set
23	204	oidc_json_parse	call site: 00204	oidc_metrics_store_counters
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup
3	103	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00103	oidc_test_key_derive_cached
3	125	oidc_cache_mutex_global_create	call site: 00125	ap_log_error_

Runtime coverage analysis

Covered functions

51

Functions that are reachable but not covered

125

Reachable functions

168

Percentage of reachable functions covered

25.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_json.c	2
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	13
/usr/include/jansson.h	2
mod_auth_openidchttp.c	2

Fuzzer: fuzz_current_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	272	57.1%
gold	[1:9]	93	19.5%
yellow	[10:29]	1	0.21%
greenyellow	[30:49]	1	0.21%
lawngreen	50+	109	22.8%
All colors	476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
100	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
88	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
9	379	oidc_check_x_forwarded_hdr	call site: 00379	oidc_util_spaced_string_to_hashtable
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup
3	103	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00103	oidc_test_key_derive_cached
3	125	oidc_cache_mutex_global_create	call site: 00125	ap_log_error_
3	129	oidc_cache_mutex_global_create	call site: 00129	ap_log_error_

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

139

Reachable functions

205

Percentage of reachable functions covered

32.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_current_url.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	13
mod_auth_openidc/test/stub.c	7
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	10
/usr/include/jansson.h	2
mod_auth_openidchttp.c	10
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcutil/url.c	11
mod_auth_openidcutil/util.c	3

Fuzzer: fuzz_post_preserve

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	445	71.6%
gold	[1:9]	103	16.5%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	73	11.7%
All colors	621	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
100	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
88	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
77	408	oidc_http_hdr_in_get	call site: 00408	_oidc_util_url_cur_port
39	553	oidc_response_post_preserve_javascript	call site: 00553	oidc_util_html_send_in_template
25	382	oidc_original_request_method	call site: 00382	oidc_util_url_redirect_uri
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
17	599	oidc_util_html_javascript_escape	call site: 00599	oidc_util_template_escape
9	534	oidc_util_read_form_encoded_params_impl	call site: 00534	oidc_util_userdata_set_post_param
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_

Runtime coverage analysis

Covered functions

68

Functions that are reachable but not covered

195

Reachable functions

255

Percentage of reachable functions covered

23.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_post_preserve.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	14
mod_auth_openidc/test/stub.c	11
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	6
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	5
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	10
/usr/include/jansson.h	2
mod_auth_openidchttp.c	15
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidchandle/response.c	1
mod_auth_openidcmod_auth_openidc.c	1
mod_auth_openidcutil/url.c	11
mod_auth_openidcutil/util.c	10
mod_auth_openidchandle/discovery.c	1
mod_auth_openidcutil/html.c	8
mod_auth_openidcutil/file.c	3
mod_auth_openidcutil/request_state.c	2

Fuzzer: fuzz_strings

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	269	47.6%
gold	[1:9]	106	18.7%
yellow	[10:29]	1	0.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	189	33.4%
All colors	565	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
73	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
59	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
26	302	oidc_json_decref	call site: 00302	_oidc_metrics_storage_set
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
13	214	oidc_json_object_get	call site: 00214	oidc_metrics_store_counter_entry
9	204	oidc_json_parse	call site: 00204	oidc_metrics_store_counters
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
5	485	oidc_http_hdr_in_get	call site: 00485	ap_log_rerror_
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup
4	500	oidc_jose_hash_bytes	call site: 00500	_oidc_jose_error_set

Runtime coverage analysis

Covered functions

96

Functions that are reachable but not covered

155

Reachable functions

243

Percentage of reachable functions covered

36.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_strings.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	11
mod_auth_openidc/test/stub.c	7
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	6
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	14
/usr/include/jansson.h	2
mod_auth_openidchttp.c	17
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcutil/html.c	5
mod_auth_openidcutil/util.c	10
mod_auth_openidcproto/jwt.c	1
mod_auth_openidcutil/base64.c	3
mod_auth_openidcstate.c	1
mod_auth_openidcjose.c	2

Fuzzer: fuzz_jwt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	671	56.6%
gold	[1:9]	205	17.2%
yellow	[10:29]	54	4.55%
greenyellow	[30:49]	8	0.67%
lawngreen	50+	247	20.8%
All colors	1185	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	734	_cjose_base64_encode_impl	call site: 00734	oidc_jwk_pkey_to_jwk
69	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
69	659	oidc_jwk_new	call site: 00659	oidc_jwk_pem_bio_read_public
59	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
30	569	_cjose_jwk_import_oct	call site: 00569	_cjose_jwk_import_OKP
30	628	oidc_jose_get_string	call site: 00628	_oidc_jwk_parse_x5c
27	200	oidc_json_parse	call site: 00200	oidc_metrics_store_counters
26	302	oidc_json_decref	call site: 00302	_oidc_metrics_storage_set
16	1077	oidc_jwt_parse	call site: 01077	oidc_jose_uncompress
15	600	cjose_const_memcmp	call site: 00600	_cjose_jwk_OKP_new
9	442	cjose_jwk_create_EC_spec	call site: 00442	cjose_err_message
9	904	_cjose_header_validate_crit	call site: 00904	cjose_err_message

Runtime coverage analysis

Covered functions

159

Functions that are reachable but not covered

227

Reachable functions

359

Percentage of reachable functions covered

36.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_jwt.c	3
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	19
cjosejwk.c	31
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	13
/usr/include/jansson.h	2
mod_auth_openidchttp.c	2
mod_auth_openidcjose.c	9
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jws.c	11
mod_auth_openidcjose/jwe.c	4
cjosejwe.c	13
cjoseheader.c	3
cjosejws.c	12
cjoseversion.c	1

Fuzzer: fuzz_cookie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	415	51.1%
gold	[1:9]	93	11.4%
yellow	[10:29]	3	0.36%
greenyellow	[30:49]	3	0.36%
lawngreen	50+	297	36.6%
All colors	811	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	240	oidc_json_integer_value	call site: 00240	oidc_metrics_counter_set_or_update
50	148	_oidc_str_to_int_checked	call site: 00148	oidc_metrics_thread_run
43	476	_oidc_jose_error_set	call site: 00476	oidc_jwk_set_or_generate_kid
26	302	oidc_json_decref	call site: 00302	_oidc_metrics_storage_set
15	724	oidc_util_url_cur_is_secure	call site: 00724	oidc_http_hdr_forwarded_get
13	214	oidc_json_object_get	call site: 00214	oidc_metrics_store_counter_entry
11	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
11	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
11	658	oidc_alg2kty	call site: 00658	cjose_jwe_decrypt
9	204	oidc_json_parse	call site: 00204	oidc_metrics_store_counters
9	604	_cjose_header_validate_crit	call site: 00604	cjose_err_message
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_

Runtime coverage analysis

Covered functions

139

Functions that are reachable but not covered

172

Reachable functions

299

Percentage of reachable functions covered

42.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_cookie.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	16
mod_auth_openidc/test/stub.c	5
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	6
cjosejwk.c	6
cjoseutil.c	5
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	5
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	14
/usr/include/jansson.h	2
mod_auth_openidchttp.c	18
mod_auth_openidcutil/util.c	3
mod_auth_openidcstate.c	5
mod_auth_openidcproto/state.c	5
mod_auth_openidcutil/jwt.c	2
mod_auth_openidcproto/jwt.c	1
mod_auth_openidcutil/base64.c	2
cjoseerror.c	1
mod_auth_openidcjose.c	6
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	4
cjosejwe.c	13
cjoseheader.c	3
mod_auth_openidcjose/jws.c	1
mod_auth_openidcutil/url.c	2

Fuzzer: fuzz_bearer_token

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2048	64.8%
gold	[1:9]	151	4.77%
yellow	[10:29]	19	0.60%
greenyellow	[30:49]	104	3.29%
lawngreen	50+	837	26.4%
All colors	3159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
395	1395	oidc_oauth_provider_config	call site: 01395	oidc_oauth_metadata_provider_retrieve
262	2693	cjose_const_memcmp	call site: 02693	oidc_proto_jwks_uri_keys
238	2454	oidc_jwt_verify	call site: 02454	oidc_metadata_jwks_retrieve_and_cache
189	1931	oidc_oauth_get_cached_access_token	call site: 01931	oidc_oauth_introspect
77	840	oidc_util_url_redirect_uri	call site: 00840	_oidc_util_url_base_cur
57	240	oidc_json_integer_value	call site: 00240	oidc_metrics_counter_set_or_update
53	1818	oidc_json_array_get	call site: 01818	oidc_metadata_cert_bound_tokens_enabled
52	2357	oidc_jwt_alg2kty	call site: 02357	oidc_proto_jwks_uri_keys
43	3010	oidc_get_remote_user	call site: 03010	oidc_util_regexp_first_match
38	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
31	921	oidc_util_url_cur_matches	call site: 00921	oidc_oauth_check_userid_redirect_uri
20	178	oidc_cache_mutex_lock	call site: 00178	oidc_metrics_store

Runtime coverage analysis

Covered functions

339

Functions that are reachable but not covered

472

Reachable functions

778

Percentage of reachable functions covered

39.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_bearer_token.c	8
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	35
mod_auth_openidc/test/stub.c	15
mod_auth_openidccfg/provider.c	12
mod_auth_openidcjose/jwk.c	22
cjosejwk.c	34
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	35
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	14
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	13
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	34
mod_auth_openidcutil/random.c	4
mod_auth_openidcjson.c	41
/usr/include/jansson.h	4
mod_auth_openidchttp.c	52
mod_auth_openidcutil/base64.c	3
cjoseerror.c	1
mod_auth_openidcjose.c	11
cjosebase64.c	4
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcjose/jws.c	13
cjosejws.c	15
cjoseheader.c	3
mod_auth_openidcoauth.c	27
mod_auth_openidcutil/util.c	21
mod_auth_openidcmod_auth_openidc.c	6
mod_auth_openidcutil/url.c	11
mod_auth_openidc./metrics.h	1
mod_auth_openidchandle/revoke.c	1
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	7
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
mod_auth_openidcmetadata/oauth.c	1
mod_auth_openidcmetadata/util.c	6
mod_auth_openidcproto/profile.c	2
mod_auth_openidcproto/proto.c	2
mod_auth_openidcutil/request_state.c	6
mod_auth_openidcproto/auth.c	10
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcutil/expr.c	2
mod_auth_openidcutil/pcre_subst.c	5
mod_auth_openidcutil/appinfo.c	9

Fuzzer: fuzz_form_params

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	263	68.1%
gold	[1:9]	96	24.8%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	6.99%
All colors	386	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
100	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
88	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
5	370	oidc_util_read_form_encoded_params_impl	call site: 00370	ap_log_rerror_
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup
3	103	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00103	oidc_test_key_derive_cached
3	125	oidc_cache_mutex_global_create	call site: 00125	ap_log_error_
3	129	oidc_cache_mutex_global_create	call site: 00129	ap_log_error_

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

132

Reachable functions

174

Percentage of reachable functions covered

24.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_form_params.c	2
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	5
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	10
/usr/include/jansson.h	2
mod_auth_openidchttp.c	5
mod_auth_openidcutil/util.c	3

Fuzzer: fuzz_response_header

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	258	68.4%
gold	[1:9]	98	25.9%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	21	5.57%
All colors	377	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
100	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
88	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup
3	103	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00103	oidc_test_key_derive_cached
3	125	oidc_cache_mutex_global_create	call site: 00125	ap_log_error_
3	129	oidc_cache_mutex_global_create	call site: 00129	ap_log_error_
3	369	oidc_http_response_header	call site: 00369	fprintf

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

128

Reachable functions

165

Percentage of reachable functions covered

22.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_response_header.c	2
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	10
/usr/include/jansson.h	2
mod_auth_openidchttp.c	3

Fuzzer: fuzz_metadata

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	709	45.2%
gold	[1:9]	121	7.72%
yellow	[10:29]	29	1.85%
greenyellow	[30:49]	21	1.34%
lawngreen	50+	686	43.8%
All colors	1566	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
160	893	oidc_jwk_new	call site: 00893	oidc_jwk_pkey_to_jwk
59	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
57	240	oidc_json_integer_value	call site: 00240	oidc_metrics_counter_set_or_update
44	669	_cjose_jwk_decode_private_attribute	call site: 00669	cjose_jwk_create_EC_spec
40	806	_cjose_jwk_import_OKP	call site: 00806	cjose_jwk_create_OKP_spec
26	302	oidc_json_decref	call site: 00302	_oidc_metrics_storage_set
23	869	_oidc_jwk_parse_x5c_spec	call site: 00869	_oidc_jwk_parse_x5c
14	1097	oidc_cfg_provider_signed_jwks_uri_keys_set	call site: 01097	oidc_jwk_copy
13	214	oidc_json_object_get	call site: 00214	oidc_metrics_store_counter_entry
11	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
11	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
9	204	oidc_json_parse	call site: 00204	oidc_metrics_store_counters

Runtime coverage analysis

Covered functions

257

Functions that are reachable but not covered

285

Reachable functions

514

Percentage of reachable functions covered

44.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_metadata.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	13
mod_auth_openidc/test/stub.c	6
mod_auth_openidccfg/provider.c	131
mod_auth_openidcjose/jwk.c	24
cjosejwk.c	32
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	28
/usr/include/jansson.h	2
mod_auth_openidchttp.c	2
mod_auth_openidcmetadata/provider.c	5
mod_auth_openidcutil/util.c	3
mod_auth_openidcmetadata/util.c	9
mod_auth_openidcproto/proto.c	2
mod_auth_openidcproto/profile.c	7
mod_auth_openidcjose.c	11
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcmetadata/conf.c	14
mod_auth_openidcmetadata/client.c	3

Fuzzer: fuzz_authz_response

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3383	69.4%
gold	[1:9]	151	3.10%
yellow	[10:29]	33	0.67%
greenyellow	[30:49]	22	0.45%
lawngreen	50+	1281	26.3%
All colors	4870	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
420	1731	oidc_http_request	call site: 01731	oidc_metadata_provider_parse
291	2156	oidc_cfg_endpoint_auth_is_mtls	call site: 02156	oidc_cfg_provider_signed_jwks_uri_set
290	2703	oidc_get_provider_for_issuer	call site: 02703	oidc_metadata_get
228	2474	oidc_jose_get_string	call site: 02474	oidc_jwks_parse_json
195	4361	oidc_userinfo_retrieve_claims	call site: 04361	oidc_refresh_token_grant
132	2994	oidc_proto_profile_id_token_aud_values_get	call site: 02994	oidc_metadata_conf_parse_response
115	3256	oidc_util_url_cur_host	call site: 03256	oidc_util_url_redirect_uri
104	3803	oidc_proto_jwt_validate	call site: 03803	oidc_proto_jwks_uri_keys
71	4064	oidc_proto_endpoint_client_secret_basic	call site: 04064	oidc_proto_endpoint_auth_client_secret_jwt
57	240	oidc_json_integer_value	call site: 00240	oidc_metrics_counter_set_or_update
54	3682	oidc_jwt_alg2kty	call site: 03682	oidc_proto_jwks_uri_keys
51	4219	oidc_proto_token_endpoint_call	call site: 04219	oidc_proto_token_endpoint_dpop_retry

Runtime coverage analysis

Covered functions

467

Functions that are reachable but not covered

691

Reachable functions

1118

Percentage of reachable functions covered

38.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_authz_response.c	7
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	51
mod_auth_openidc/test/stub.c	13
mod_auth_openidccfg/provider.c	141
mod_auth_openidcjose/jwk.c	28
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	7
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	34
mod_auth_openidcutil/random.c	5
mod_auth_openidcjson.c	46
/usr/include/jansson.h	4
mod_auth_openidchttp.c	63
mod_auth_openidcproto/state.c	29
mod_auth_openidcstate.c	7
mod_auth_openidcjose.c	22
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jws.c	15
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
cjoseheader.c	3
cjosejws.c	15
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcutil/util.c	23
mod_auth_openidcsession.c	56
mod_auth_openidcproto/jwt.c	8
mod_auth_openidc./metrics.h	2
mod_auth_openidcutil/url.c	8
mod_auth_openidcutil/request_state.c	3
mod_auth_openidchandle/response.c	15
mod_auth_openidcutil/html.c	10
mod_auth_openidcmod_auth_openidc.c	5
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	15
mod_auth_openidcproto/proto.c	3
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	8
mod_auth_openidcmetadata.c	1
mod_auth_openidcutil/file.c	4
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6
mod_auth_openidcproto/response.c	16
mod_auth_openidcproto/id_token.c	12
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/token.c	8
mod_auth_openidcproto/auth.c	10
mod_auth_openidcproto/dpop.c	2
mod_auth_openidchandle/userinfo.c	2
mod_auth_openidcproto/userinfo.c	7
mod_auth_openidchandle/refresh.c	7
mod_auth_openidcutil/expr.c	2
mod_auth_openidcutil/pcre_subst.c	5

Fuzzer: fuzz_backchannel_logout

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3339	75.7%
gold	[1:9]	200	4.53%
yellow	[10:29]	57	1.29%
greenyellow	[30:49]	43	0.97%
lawngreen	50+	769	17.4%
All colors	4408	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
539	1386	oidc_json_array_get	call site: 01386	oidc_metadata_provider_parse
386	4018	oidc_logout	call site: 04018	oidc_logout_build_op_request
296	1926	oidc_proto_profile_ops	call site: 01926	oidc_cfg_provider_signed_jwks_uri_set
292	2480	oidc_get_provider_for_issuer	call site: 02480	oidc_metadata_get
261	2773	oidc_proto_profile_id_token_aud_values_get	call site: 02773	oidc_metadata_client_get
232	2247	oidc_jose_get_string	call site: 02247	oidc_jwks_parse_json
176	3040	oidc_util_url_cur_host	call site: 03040	oidc_http_post_json
171	3224	oidc_json_array_has_value	call site: 03224	oidc_logout_revoke_one_token
102	3745	oidc_proto_validate_iat	call site: 03745	oidc_proto_jwks_uri_keys
57	240	oidc_json_integer_value	call site: 00240	oidc_metrics_counter_set_or_update
52	3624	oidc_jwt_alg2kty	call site: 03624	oidc_proto_jwks_uri_keys
32	1236	oidc_session_save	call site: 01236	oidc_session_save_cookie

Runtime coverage analysis

Covered functions

327

Functions that are reachable but not covered

728

Reachable functions

1024

Percentage of reachable functions covered

28.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c	4
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	45
mod_auth_openidc/test/stub.c	13
mod_auth_openidccfg/provider.c	141
mod_auth_openidcjose/jwk.c	28
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	6
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	34
mod_auth_openidcutil/random.c	5
mod_auth_openidcjson.c	44
/usr/include/jansson.h	4
mod_auth_openidchttp.c	63
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcjose.c	18
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jws.c	15
cjosejws.c	15
cjoseheader.c	3
mod_auth_openidcsession.c	44
mod_auth_openidcutil/util.c	20
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	8
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
mod_auth_openidc./metrics.h	1
mod_auth_openidcutil/url.c	9
mod_auth_openidcutil/request_state.c	3
mod_auth_openidchandle/logout.c	19
mod_auth_openidcmod_auth_openidc.c	11
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	15
mod_auth_openidcproto/proto.c	3
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	9
mod_auth_openidcmetadata.c	1
mod_auth_openidcutil/file.c	4
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6
mod_auth_openidcproto/auth.c	10
mod_auth_openidchandle/response.c	1
mod_auth_openidcutil/html.c	2
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/id_token.c	8
mod_auth_openidcutil/expr.c	1
mod_auth_openidcutil/pcre_subst.c	4
mod_auth_openidchandle/refresh.c	7
mod_auth_openidcproto/token.c	8
mod_auth_openidcproto/dpop.c	2

Fuzzer: fuzz_pem_key

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	367	50.1%
gold	[1:9]	117	15.9%
yellow	[10:29]	26	3.55%
greenyellow	[30:49]	67	9.15%
lawngreen	50+	155	21.1%
All colors	732	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
88	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
69	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
28	300	oidc_json_encode	call site: 00300	_oidc_metrics_storage_set
11	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
11	554	cjose_jwk_create_RSA_spec	call site: 00554	cjose_err_message
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
7	489	cjose_base64url_encode	call site: 00489	cjose_err_message
7	546	cjose_jwk_create_RSA_spec	call site: 00546	BN_bin2bn
5	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	699	oidc_jwk_to_json	call site: 00699	_oidc_jose_error_set
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_

Runtime coverage analysis

Covered functions

111

Functions that are reachable but not covered

188

Reachable functions

276

Percentage of reachable functions covered

31.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_pem_key.c	3
mod_auth_openidc/test/util.c	5
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	3
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	17
cjosejwk.c	15
cjoseutil.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	13
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	10
/usr/include/jansson.h	4
mod_auth_openidchttp.c	2
mod_auth_openidcutil/base64.c	2
mod_auth_openidcjose.c	3
cjosebase64.c	2
cjoseerror.c	1

Fuzzer: fuzz_jwks

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	409	43.8%
gold	[1:9]	198	21.2%
yellow	[10:29]	18	1.93%
greenyellow	[30:49]	11	1.18%
lawngreen	50+	296	31.7%
All colors	932	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
69	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
59	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
32	778	_oidc_jwk_rsa_key_to_jwk	call site: 00778	_oidc_jwk_ec_key_to_jwk
26	302	oidc_json_decref	call site: 00302	_oidc_metrics_storage_set
23	204	oidc_json_parse	call site: 00204	oidc_metrics_store_counters
11	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup
4	386	oidc_jwk_parse	call site: 00386	cjose_err_message

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

192

Reachable functions

311

Percentage of reachable functions covered

38.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_jwks.c	3
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	26
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	13
/usr/include/jansson.h	4
mod_auth_openidchttp.c	2
mod_auth_openidcjose.c	4
cjoseerror.c	1
cjosebase64.c	4

Fuzzer: fuzz_state_cookie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	366	51.4%
gold	[1:9]	168	23.5%
yellow	[10:29]	4	0.56%
greenyellow	[30:49]	8	1.12%
lawngreen	50+	166	23.3%
All colors	712	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
59	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
57	240	oidc_json_integer_value	call site: 00240	oidc_metrics_counter_set_or_update
43	425	_oidc_jose_error_set	call site: 00425	oidc_jwk_set_or_generate_kid
26	302	oidc_json_decref	call site: 00302	_oidc_metrics_storage_set
11	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
11	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
9	204	oidc_json_parse	call site: 00204	oidc_metrics_store_counters
9	218	oidc_json_object_set_new	call site: 00218	oidc_metrics_store_counter_entry
9	553	_cjose_header_validate_crit	call site: 00553	cjose_err_message
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
8	607	oidc_alg2kty	call site: 00607	_oidc_jose_error_set
5	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy

Runtime coverage analysis

Covered functions

127

Functions that are reachable but not covered

159

Reachable functions

274

Percentage of reachable functions covered

41.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_state_cookie.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	10
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	6
cjosejwk.c	6
cjoseutil.c	5
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	16
/usr/include/jansson.h	2
mod_auth_openidchttp.c	2
mod_auth_openidcproto/state.c	17
mod_auth_openidcutil/jwt.c	2
mod_auth_openidcproto/jwt.c	1
mod_auth_openidcutil/base64.c	2
cjoseerror.c	1
mod_auth_openidcjose.c	6
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	4
cjosejwe.c	13
cjoseheader.c	3
mod_auth_openidcjose/jws.c	1

Fuzzer: fuzz_base64

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	256	69.7%
gold	[1:9]	98	26.7%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	4	1.08%
lawngreen	50+	8	2.17%
All colors	367	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
100	228	_oidc_strstr	call site: 00228	oidc_metrics_counter_set_or_update
88	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run
18	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	114	oidc_cache_mutex_global_create	call site: 00114	ap_log_error_
5	74	_oidc_strnatcasecmp	call site: 00074	_oidc_strnatcasecmp
5	335	oidc_cfg_parse_option	call site: 00335	oidc_cfg_parse_options_flatten
4	134	oidc_cache_mutex_global_create	call site: 00134	ap_log_error_
4	348	oidc_http_curl_pool_init	call site: 00348	oidc_http_curl_pool_cleanup
3	103	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00103	oidc_test_key_derive_cached
3	125	oidc_cache_mutex_global_create	call site: 00125	ap_log_error_
3	129	oidc_cache_mutex_global_create	call site: 00129	ap_log_error_
2	65	oidc_test_request_init	call site: 00065	oidc_cfg_provider_authorization_endpoint_url_valid

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

131

Reachable functions

168

Percentage of reachable functions covered

22.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_base64.c	2
mod_auth_openidc/test/util.c	5
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	3
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	6
mod_auth_openidcmetrics.c	24
mod_auth_openidcutil/random.c	2
mod_auth_openidcjson.c	10
/usr/include/jansson.h	2
mod_auth_openidchttp.c	2
mod_auth_openidcutil/base64.c	2

Fuzzer: fuzz_discovery_response

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3367	81.8%
gold	[1:9]	106	2.57%
yellow	[10:29]	4	0.09%
greenyellow	[30:49]	5	0.12%
lawngreen	50+	634	15.4%
All colors	4116	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
703	3411	oidc_request_authenticate_user	call site: 03411	oidc_discovery_response_authenticate
555	1776	oidc_proto_profile_ops	call site: 01776	oidc_cfg_provider_signed_jwks_uri_set
506	2592	oidc_proto_request_auth_params_set	call site: 02592	oidc_proto_request_object_param_add
385	1195	oidc_http_query_encoded_url	call site: 01195	oidc_http_request
183	3100	oidc_proto_profile_auth_request_method_get	call site: 03100	oidc_proto_request_auth_push
138	1035	oidc_util_jwt_verify	call site: 01035	oidc_metadata_provider_retrieve
98	3299	oidc_response_post_preserve_javascript	call site: 03299	oidc_original_request_method
83	1692	oidc_util_jwt_create	call site: 01692	oidc_metadata_provider_parse
60	237	oidc_json_integer	call site: 00237	oidc_metrics_counter_set_or_update
39	717	oidc_util_base64url_encode	call site: 00717	oidc_cache_crypto_decrypt
33	601	oidc_validate_redirect_url	call site: 00601	oidc_validate_redirect_url_allowed
29	139	oidc_cfg_post_config	call site: 00139	oidc_metrics_thread_run

Runtime coverage analysis

Covered functions

249

Functions that are reachable but not covered

763

Reachable functions

991

Percentage of reachable functions covered

23.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_discovery_response.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	44
mod_auth_openidc/test/stub.c	13
mod_auth_openidccfg/provider.c	140
mod_auth_openidcjose/jwk.c	27
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	17
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	7
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	34
mod_auth_openidcutil/random.c	4
mod_auth_openidcjson.c	43
/usr/include/jansson.h	4
mod_auth_openidchttp.c	56
mod_auth_openidchandle/discovery.c	10
mod_auth_openidcutil/url.c	12
mod_auth_openidcutil/util.c	20
mod_auth_openidcutil/html.c	10
mod_auth_openidcmod_auth_openidc.c	9
mod_auth_openidcutil/expr.c	1
mod_auth_openidcutil/pcre_subst.c	4
mod_auth_openidcjose.c	18
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	5
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
cjoseheader.c	3
mod_auth_openidcjose/jws.c	13
mod_auth_openidc./metrics.h	1
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	15
mod_auth_openidcproto/proto.c	4
cjosejws.c	15
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	9
mod_auth_openidchandle/request.c	9
mod_auth_openidcutil/request_state.c	3
mod_auth_openidcproto/state.c	24
mod_auth_openidcstate.c	7
mod_auth_openidcproto/request.c	4
mod_auth_openidcproto/request_object.c	14
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/auth.c	10
mod_auth_openidchandle/response.c	1
mod_auth_openidcutil/file.c	4
mod_auth_openidcproto/discovery.c	4
mod_auth_openidcmetadata.c	1
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6

Fuzzer: fuzz_redirect_uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4207	80.0%
gold	[1:9]	317	6.03%
yellow	[10:29]	68	1.29%
greenyellow	[30:49]	6	0.11%
lawngreen	50+	659	12.5%
All colors	5257	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
546	2007	oidc_cfg_endpoint_auth_is_mtls	call site: 02007	oidc_cfg_provider_signed_jwks_uri_set
418	1584	oidc_http_request	call site: 01584	oidc_metadata_provider_parse
415	3505	oidc_jwt_parse	call site: 03505	oidc_proto_jwt_verify
354	2626	oidc_util_rand_str	call site: 02626	oidc_metadata_conf_parse
296	4465	oidc_refresh_token_grant_obtain_tokens	call site: 04465	oidc_proto_userinfo_request
252	4150	oidc_proto_token_endpoint_call	call site: 04150	oidc_userinfo_retrieve_claims
202	3110	oidc_util_url_cur_host	call site: 03110	oidc_http_post_json
123	3943	oidc_proto_endpoint_client_secret_basic	call site: 03943	oidc_proto_endpoint_auth_client_secret_jwt
86	5168	oidc_util_read_post_params_impl	call site: 05168	oidc_metadata_list
76	4972	oidc_session_get_idtoken	call site: 04972	oidc_session_save
68	2554	oidc_get_provider_for_issuer	call site: 02554	oidc_metadata_get
60	237	oidc_json_integer	call site: 00237	oidc_metrics_counter_set_or_update

Runtime coverage analysis

Covered functions

458

Functions that are reachable but not covered

850

Reachable functions

1193

Percentage of reachable functions covered

28.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	56
mod_auth_openidc/test/stub.c	18
mod_auth_openidccfg/provider.c	141
mod_auth_openidcjose/jwk.c	28
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	8
mod_auth_openidccfg/dir.c	15
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	41
mod_auth_openidcutil/random.c	5
mod_auth_openidcjson.c	46
/usr/include/jansson.h	4
mod_auth_openidchttp.c	66
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcsession.c	70
mod_auth_openidcutil/util.c	24
mod_auth_openidcjose.c	22
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	8
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
cjoseheader.c	3
mod_auth_openidcjose/jws.c	15
mod_auth_openidc./metrics.h	2
cjosejws.c	15
mod_auth_openidcutil/url.c	13
mod_auth_openidcutil/request_state.c	3
mod_auth_openidcmod_auth_openidc.c	10
mod_auth_openidchandle/response.c	15
mod_auth_openidcstate.c	7
mod_auth_openidcproto/state.c	18
mod_auth_openidcutil/html.c	12
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	16
mod_auth_openidcproto/proto.c	3
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	8
mod_auth_openidcmetadata.c	2
mod_auth_openidcutil/file.c	4
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6
mod_auth_openidcproto/response.c	16
mod_auth_openidcproto/id_token.c	12
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/token.c	8
mod_auth_openidcproto/auth.c	10
mod_auth_openidcproto/dpop.c	2
mod_auth_openidchandle/userinfo.c	3
mod_auth_openidcproto/userinfo.c	7
mod_auth_openidchandle/refresh.c	7
mod_auth_openidcutil/expr.c	3
mod_auth_openidcutil/pcre_subst.c	5
mod_auth_openidchandle/content.c	3
mod_auth_openidchandle/info.c	6
mod_auth_openidcutil/appinfo.c	5
mod_auth_openidchandle/dpop.c	1
mod_auth_openidchandle/jwks.c	1
mod_auth_openidchandle/discovery.c	6

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
oidc_register_hooks	/src/mod_auth_openidc/src/mod_auth_openidc.c	1	['N/A']	19	0	23	3	2	1414	0	10665	711
oidc_authz_24_checker_claim	/src/mod_auth_openidc/src/handle/authz.c	3	['N/A', 'N/A', 'N/A']	24	0	21	3	2	762	0	5608	259
_cjose_jwe_encrypt_ek_ecdh_es_a256kw	/src/cjose/src/jwe.c	4	['N/A', 'N/A', 'N/A', 'N/A']	6	0	24	3	2	66	0	368	157
oidc_cache_file_set	/src/mod_auth_openidc/src/cache/file.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	6	0	511	84	28	46	0	285	147
oidc_session_management	/src/mod_auth_openidc/src/handle/session_management.c	3	['N/A', 'N/A', 'N/A']	22	0	783	143	49	957	0	6475	103
oidc_cache_shm_set	/src/mod_auth_openidc/src/cache/shm.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	5	0	417	61	21	55	0	183	84
_cjose_jwe_decrypt_dat_aes_cbc	/src/cjose/src/jwe.c	2	['N/A', 'N/A']	4	0	700	108	37	28	0	126	78

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1334 / 1767

Cyclomatic complexity statically reachable by fuzzers

11553 / 14089

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

mod_auth_openidc/test/fuzz/fuzz_url.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_util_regexp_first_match', 'oidc_cache_mutex_global_create', 'oidc_util_strcasestr', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_validate_redirect_url_host', 'oidc_http_hdr_in_get']

mod_auth_openidc/test/fuzz/fuzz_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_json_decref', 'oidc_json_parse', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init']

mod_auth_openidc/test/fuzz/fuzz_current_url.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_check_x_forwarded_hdr', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_post_preserve.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_http_hdr_in_get', 'oidc_response_post_preserve_javascript', 'oidc_original_request_method', 'oidc_cfg_server_alloc', 'oidc_util_html_javascript_escape', 'oidc_util_read_form_encoded_params_impl', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp']

mod_auth_openidc/test/fuzz/fuzz_strings.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_json_decref', 'oidc_cfg_server_alloc', 'oidc_json_object_get', 'oidc_json_parse', 'oidc_cache_mutex_global_create', 'oidc_cfg_parse_option', 'oidc_http_hdr_in_get']

mod_auth_openidc/test/fuzz/fuzz_jwt.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cjose_base64_encode_impl', '_oidc_strstr', 'oidc_jwk_new', 'oidc_cfg_post_config', '_cjose_jwk_import_oct', 'oidc_jose_get_string', 'oidc_json_parse', 'oidc_json_decref', 'oidc_jwt_parse', 'cjose_const_memcmp']

mod_auth_openidc/test/fuzz/fuzz_cookie.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_json_integer_value', '_oidc_str_to_int_checked', '_oidc_jose_error_set', 'oidc_json_decref', 'oidc_util_url_cur_is_secure', 'oidc_json_object_get', 'cjose_jwk_release', '_oidc_strstr', 'oidc_alg2kty', 'oidc_json_parse']

mod_auth_openidc/test/fuzz/fuzz_bearer_token.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_oauth_provider_config', 'cjose_const_memcmp', 'oidc_jwt_verify', 'oidc_oauth_get_cached_access_token', 'oidc_util_url_redirect_uri', 'oidc_json_integer_value', 'oidc_json_array_get', 'oidc_jwt_alg2kty', 'oidc_get_remote_user', 'oidc_cfg_post_config']

mod_auth_openidc/test/fuzz/fuzz_form_params.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_util_read_form_encoded_params_impl', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_response_header.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_metadata.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_jwk_new', 'oidc_cfg_post_config', 'oidc_json_integer_value', '_cjose_jwk_decode_private_attribute', '_cjose_jwk_import_OKP', 'oidc_json_decref', '_oidc_jwk_parse_x5c_spec', 'oidc_cfg_provider_signed_jwks_uri_keys_set', 'oidc_json_object_get', 'cjose_jwk_release']

mod_auth_openidc/test/fuzz/fuzz_authz_response.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_http_request', 'oidc_cfg_endpoint_auth_is_mtls', 'oidc_get_provider_for_issuer', 'oidc_jose_get_string', 'oidc_userinfo_retrieve_claims', 'oidc_proto_profile_id_token_aud_values_get', 'oidc_util_url_cur_host', 'oidc_proto_jwt_validate', 'oidc_proto_endpoint_client_secret_basic', 'oidc_json_integer_value']

mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_json_array_get', 'oidc_logout', 'oidc_proto_profile_ops', 'oidc_get_provider_for_issuer', 'oidc_proto_profile_id_token_aud_values_get', 'oidc_jose_get_string', 'oidc_util_url_cur_host', 'oidc_json_array_has_value', 'oidc_proto_validate_iat', 'oidc_json_integer_value']

mod_auth_openidc/test/fuzz/fuzz_pem_key.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', '_oidc_strstr', 'oidc_json_encode', 'cjose_jwk_release', 'cjose_jwk_create_RSA_spec', 'oidc_cache_mutex_global_create', 'cjose_base64url_encode', 'oidc_cfg_server_alloc', '_oidc_strnatcasecmp']

mod_auth_openidc/test/fuzz/fuzz_jwks.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', '_oidc_jwk_rsa_key_to_jwk', 'oidc_json_decref', 'oidc_json_parse', 'cjose_jwk_release', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option']

mod_auth_openidc/test/fuzz/fuzz_state_cookie.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_json_integer_value', '_oidc_jose_error_set', 'oidc_json_decref', 'cjose_jwk_release', '_oidc_strstr', 'oidc_json_parse', 'oidc_json_object_set_new', '_cjose_header_validate_crit', 'oidc_cache_mutex_global_create']

mod_auth_openidc/test/fuzz/fuzz_base64.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_strstr', 'oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_discovery_response.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_request_authenticate_user', 'oidc_proto_profile_ops', 'oidc_proto_request_auth_params_set', 'oidc_http_query_encoded_url', 'oidc_proto_profile_auth_request_method_get', 'oidc_util_jwt_verify', 'oidc_response_post_preserve_javascript', 'oidc_util_jwt_create', 'oidc_json_integer', 'oidc_util_base64url_encode']

mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_endpoint_auth_is_mtls', 'oidc_http_request', 'oidc_jwt_parse', 'oidc_util_rand_str', 'oidc_refresh_token_grant_obtain_tokens', 'oidc_proto_token_endpoint_call', 'oidc_util_url_cur_host', 'oidc_proto_endpoint_client_secret_basic', 'oidc_util_read_post_params_impl', 'oidc_session_get_idtoken']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
_cjose_header_validate_crit	47	10	21.27%	['fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_cookie', 'fuzz_jwt', 'fuzz_bearer_token', 'fuzz_redirect_uri']
_cjose_jwe_decrypt_dat_aes_cbc	85	38	44.70%	['fuzz_jwt']
_cjose_jwe_validate_decrypt_key	31	14	45.16%	['fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_cookie', 'fuzz_jwt', 'fuzz_bearer_token', 'fuzz_redirect_uri']
_cjose_jws_build_dig_sha	77	40	51.94%	['fuzz_jwt']
_cjose_jws_build_dig_hmac_sha	85	41	48.23%	['fuzz_backchannel_logout', 'fuzz_authz_response', 'fuzz_jwt', 'fuzz_bearer_token']
_cjose_jws_validate_verify_key	47	19	40.42%	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_jwt', 'fuzz_bearer_token', 'fuzz_redirect_uri']
oidc_state_cookies_delete_oldest	31	8	25.80%	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_redirect_uri']
cjose_jwe_encrypt_multi_iv	101	35	34.65%	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_bearer_token', 'fuzz_redirect_uri']
_cjose_jwe_encrypt_dat_aes_gcm	86	34	39.53%	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_bearer_token', 'fuzz_redirect_uri']
cjose_jws_sign	46	14	30.43%	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_bearer_token', 'fuzz_redirect_uri']
oidc_oauth_get_cached_access_token	31	17	54.83%	['fuzz_bearer_token']
oidc_oauth_parse_and_cache_token_expiry	39	12	30.76%	['fuzz_bearer_token']
oidc_proto_jwt_verify	53	27	50.94%	['fuzz_backchannel_logout', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri']
oidc_util_set_trace_parent	54	14	25.92%	['fuzz_backchannel_logout', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri']
oidc_response_proto_state_restore	41	21	51.21%	['fuzz_authz_response', 'fuzz_redirect_uri']
oidc_userinfo_retrieve_claims	66	15	22.72%	['fuzz_authz_response', 'fuzz_redirect_uri']
oidc_http_request	102	23	22.54%	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_bearer_token', 'fuzz_redirect_uri']
oidc_provider_static_config	38	8	21.05%	['fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri']
oidc_proto_token_endpoint_auth	41	10	24.39%	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_bearer_token', 'fuzz_redirect_uri']
oidc_proto_idtoken_validate_aud_array	36	17	47.22%	['fuzz_backchannel_logout', 'fuzz_authz_response', 'fuzz_redirect_uri']
oidc_proto_resolve_code_and_validate_response	40	18	45.0%	['fuzz_authz_response', 'fuzz_redirect_uri']
oidc_logout_cleanup_by_sid	33	17	51.51%	['fuzz_backchannel_logout', 'fuzz_redirect_uri']
cjose_jwk_to_json	69	35	50.72%	['fuzz_discovery_response', 'fuzz_jwks', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_bearer_token', 'fuzz_redirect_uri']
_cjose_jwk_RSA_private_fields	34	16	47.05%	['fuzz_jwks', 'fuzz_pem_key']
oidc_request_check_cookie_domain	39	21	53.84%	['fuzz_discovery_response', 'fuzz_redirect_uri']
oidc_dpop_request	59	19	32.20%	['fuzz_redirect_uri']
oidc_info_request	46	21	45.65%	['fuzz_redirect_uri']
oidc_logout_revoke_tokens	32	16	50.0%	['fuzz_backchannel_logout', 'fuzz_redirect_uri']
oidc_refresh_token_grant	36	16	44.44%	['fuzz_backchannel_logout', 'fuzz_authz_response', 'fuzz_redirect_uri']
oidc_refresh_token_cache_get	46	24	52.17%	['fuzz_backchannel_logout', 'fuzz_authz_response', 'fuzz_redirect_uri']
oidc_handle_existing_session	48	15	31.25%	['fuzz_redirect_uri']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/mod_auth_openidc/src/cfg/cfg.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/cfg/dir.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/jose/jwe.c	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/cjose/src/concatkdf.c	[]	[]
/src/mod_auth_openidc/src/proto/jwks.c	['fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/handle/discovery.c	['fuzz_post_preserve', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/proto.c	['fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_bearer_token', 'fuzz_metadata', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/handle/revoke.c	['fuzz_bearer_token']	[]
/src/mod_auth_openidc/src/util/url.c	['fuzz_url', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_current_url', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/metadata/provider.c	['fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_metadata']
/src/mod_auth_openidc/src/cache/shm.c	[]	[]
/src/mod_auth_openidc/src/proto/discovery.c	['fuzz_discovery_response']	[]
/src/mod_auth_openidc/src/handle/session_management.c	[]	[]
/src/mod_auth_openidc/src/handle/authz.c	[]	[]
/src/mod_auth_openidc/src/util/request_state.c	['fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/cache/common.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_strings.c	['fuzz_strings']	['fuzz_strings']
/src/mod_auth_openidc/src/cache/memcache.c	[]	[]
/src/mod_auth_openidc/src/util/util.c	['fuzz_url', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/state.c	['fuzz_cookie', 'fuzz_authz_response', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_cookie', 'fuzz_authz_response', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_current_url.c	['fuzz_current_url']	['fuzz_current_url']
/src/cjose/src/error.c	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/json.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_json', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/handle/logout.c	['fuzz_backchannel_logout']	['fuzz_backchannel_logout']
/src/mod_auth_openidc/src/jose.c	['fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_metadata.c	['fuzz_metadata']	['fuzz_metadata']
/src/mod_auth_openidc/src/cfg/provider.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz.h	['fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']	['fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/stub.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/cjose/src/jws.c	['fuzz_jwt', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/state.c	['fuzz_strings', 'fuzz_cookie', 'fuzz_authz_response', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_strings', 'fuzz_cookie', 'fuzz_authz_response', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/cjose/src/jwe.c	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/metadata/conf.c	['fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_metadata']
/src/mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/session.c	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/util/random.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/id_token.c	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']	['fuzz_authz_response', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/handle/info.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/auth.c	['fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_authz_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/profile.c	['fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/usr/include/jansson.h	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/cfg/parse.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/cjose/src/base64.c	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/util.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/cache/file.c	[]	[]
/src/mod_auth_openidc/src/cfg/cache.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/handle/refresh.c	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/cjose/src/header.c	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_url.c	['fuzz_url']	['fuzz_url']
/src/mod_auth_openidc/src/util/jwt.c	['fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/cjose/src/jwk.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_state_cookie.c	['fuzz_state_cookie']	['fuzz_state_cookie']
/src/mod_auth_openidc/src/./metrics.h	['fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/test/fuzz/fuzz_bearer_token.c	['fuzz_bearer_token']	['fuzz_bearer_token']
/src/mod_auth_openidc/src/util/key.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/jose/jws.c	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_json.c	['fuzz_json']	['fuzz_json']
/src/mod_auth_openidc/src/proto/response.c	['fuzz_authz_response', 'fuzz_redirect_uri']	['fuzz_authz_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/dpop.c	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/handle/response.c	['fuzz_post_preserve', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_post_preserve', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/metadata/util.c	['fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_metadata']
/src/mod_auth_openidc/src/metadata/oauth.c	['fuzz_bearer_token']	[]
/src/mod_auth_openidc/src/./cfg/cfg_int.h	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/handle/request_uri.c	[]	[]
/src/mod_auth_openidc/src/cfg/check.c	[]	[]
/src/mod_auth_openidc/src/handle/userinfo.c	['fuzz_authz_response', 'fuzz_redirect_uri']	['fuzz_authz_response']
/src/mod_auth_openidc/src/util/appinfo.c	['fuzz_bearer_token', 'fuzz_redirect_uri']	['fuzz_bearer_token']
/src/mod_auth_openidc/src/util/pcre_subst.c	['fuzz_url', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url']
/src/mod_auth_openidc/src/mod_auth_openidc.c	['fuzz_url', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/cfg/oauth.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/handle/dpop.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_post_preserve.c	['fuzz_post_preserve']	['fuzz_post_preserve']
/src/mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c	['fuzz_backchannel_logout']	['fuzz_backchannel_logout']
/src/mod_auth_openidc/src/util/expr.c	['fuzz_url', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/metadata/jwks.c	['fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/test/fuzz/fuzz_form_params.c	['fuzz_form_params']	['fuzz_form_params']
/src/cjose/src/util.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/http.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/metadata.c	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/test/fuzz/fuzz_response_header.c	['fuzz_response_header']	['fuzz_response_header']
/src/mod_auth_openidc/test/fuzz/fuzz_pem_key.c	['fuzz_pem_key']	['fuzz_pem_key']
/src/mod_auth_openidc/src/oauth.c	['fuzz_bearer_token']	['fuzz_bearer_token']
/src/cjose/src/version.c	['fuzz_jwt', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_bearer_token', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_discovery_response.c	['fuzz_discovery_response']	['fuzz_discovery_response']
/src/mod_auth_openidc/src/proto/pkce.c	[]	[]
/src/mod_auth_openidc/src/proto/request_object.c	['fuzz_discovery_response']	[]
/src/mod_auth_openidc/test/fuzz/fuzz_base64.c	['fuzz_base64']	['fuzz_base64']
/src/mod_auth_openidc/src/proto/jwt.c	['fuzz_strings', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_strings', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/jose/jwk.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_jwt.c	['fuzz_jwt']	['fuzz_jwt']
/src/mod_auth_openidc/test/fuzz/fuzz_cookie.c	['fuzz_cookie']	['fuzz_cookie']
/src/mod_auth_openidc/src/util/html.c	['fuzz_post_preserve', 'fuzz_strings', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_post_preserve', 'fuzz_strings', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/request.c	['fuzz_discovery_response']	['fuzz_discovery_response']
/src/mod_auth_openidc/test/fuzz/fuzz_authz_response.c	['fuzz_authz_response']	['fuzz_authz_response']
/src/mod_auth_openidc/src/util/base64.c	['fuzz_strings', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_strings', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/userinfo.c	['fuzz_authz_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/metrics.c	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/handle/request.c	['fuzz_discovery_response']	['fuzz_discovery_response']
/src/mod_auth_openidc/src/./const.h	['fuzz_url', 'fuzz_json', 'fuzz_current_url', 'fuzz_post_preserve', 'fuzz_strings', 'fuzz_jwt', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_form_params', 'fuzz_response_header', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_state_cookie', 'fuzz_base64', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/util/file.c	['fuzz_post_preserve', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/src/handle/jwks.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/proto/token.c	['fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_redirect_uri']	['fuzz_authz_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/metadata/client.c	['fuzz_metadata', 'fuzz_authz_response', 'fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_redirect_uri']	['fuzz_metadata']
/src/mod_auth_openidc/test/fuzz/fuzz_jwks.c	['fuzz_jwks']	['fuzz_jwks']
/src/mod_auth_openidc/src/handle/content.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']

Directories in report

Directory
/src/mod_auth_openidc/src/cache/
/usr/include/
/src/mod_auth_openidc/src/metadata/
/src/mod_auth_openidc/src/
/src/mod_auth_openidc/src/util/
/src/mod_auth_openidc/src/./
/src/cjose/src/
/src/mod_auth_openidc/test/
/src/mod_auth_openidc/src/jose/
/src/mod_auth_openidc/src/handle/
/src/mod_auth_openidc/src/proto/
/src/mod_auth_openidc/src/cfg/
/src/mod_auth_openidc/src/./cfg/
/src/mod_auth_openidc/test/fuzz/