High level conclusions

Fuzzers reach 52.13% code coverage.

Fuzzers reach 71.23% of cyclomatic complexity.

Fuzzers reach 65.85% of all functions.

Fuzzer fuzz_backchannel_logout is blocked:

The runtime code coverage of fuzz_backchannel_logout covers 29.54% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_redirect_uri is blocked:

The runtime code coverage of fuzz_redirect_uri covers 29.27% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_discovery_response is blocked:

The runtime code coverage of fuzz_discovery_response covers 23.54% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1190 / 1807

Cyclomatic complexity statically reachable by fuzzers

10121 / 14208

Runtime code coverage of functions

942 / 1807

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	41.8%
gold	[1:9]	102	31.8%
yellow	[10:29]	9	2.81%
greenyellow	[30:49]	2	0.62%
lawngreen	50+	73	22.8%
All colors	320	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
9	247	oidc_util_regexp_first_match	call site: 00247	pcre2_substring_get_bynumber_8
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
6	277	oidc_util_strcasestr	call site: 00277	oidc_http_hdr_in_x_forwarded_host_get
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
5	265	oidc_validate_redirect_url_host	call site: 00265	oidc_http_hdr_forwarded_get
5	271	oidc_http_hdr_in_get	call site: 00271	oidc_util_strcasestr
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached

Runtime coverage analysis

Covered functions

64

Functions that are reachable but not covered

90

Reachable functions

146

Percentage of reachable functions covered

38.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_url.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	10
mod_auth_openidc/test/stub.c	5
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	8
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	8
mod_auth_openidcmod_auth_openidc.c	6
mod_auth_openidcutil/expr.c	1
mod_auth_openidcutil/pcre_subst.c	4
mod_auth_openidcutil/url.c	1
mod_auth_openidcutil/util.c	1

Fuzzer: fuzz_base64

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	100	47.3%
gold	[1:9]	98	46.4%
yellow	[10:29]	1	0.47%
greenyellow	[30:49]	4	1.89%
lawngreen	50+	8	3.79%
All colors	211	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached
3	127	oidc_cache_mutex_global_create	call site: 00127	ap_log_error_
3	131	oidc_cache_mutex_global_create	call site: 00131	ap_log_error_
2	67	oidc_test_request_init	call site: 00067	oidc_cfg_provider_authorization_endpoint_url_valid
2	72	oidc_cfg_parse_is_valid_url_scheme	call site: 00072	apr_psprintf

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

74

Reachable functions

111

Percentage of reachable functions covered

33.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_base64.c	2
mod_auth_openidc/test/util.c	5
mod_auth_openidccfg/cfg.c	8
mod_auth_openidc/test/stub.c	3
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	2
mod_auth_openidcutil/base64.c	2

Fuzzer: fuzz_form_params

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	46.5%
gold	[1:9]	96	41.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	11.7%
All colors	230	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
5	214	oidc_util_read_form_encoded_params_impl	call site: 00214	ap_log_rerror_
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached
3	127	oidc_cache_mutex_global_create	call site: 00127	ap_log_error_
3	131	oidc_cache_mutex_global_create	call site: 00131	ap_log_error_
2	67	oidc_test_request_init	call site: 00067	oidc_cfg_provider_authorization_endpoint_url_valid

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

75

Reachable functions

117

Percentage of reachable functions covered

35.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_form_params.c	2
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	8
mod_auth_openidc/test/stub.c	5
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	5
mod_auth_openidcutil/util.c	3

Fuzzer: fuzz_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	45.5%
gold	[1:9]	104	46.4%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	18	8.03%
All colors	224	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached
3	127	oidc_cache_mutex_global_create	call site: 00127	ap_log_error_
3	131	oidc_cache_mutex_global_create	call site: 00131	ap_log_error_
2	67	oidc_test_request_init	call site: 00067	oidc_cfg_provider_authorization_endpoint_url_valid
2	72	oidc_cfg_parse_is_valid_url_scheme	call site: 00072	apr_psprintf

Runtime coverage analysis

Covered functions

51

Functions that are reachable but not covered

75

Reachable functions

118

Percentage of reachable functions covered

36.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_json.c	2
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	8
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	2
mod_auth_openidcjson.c	6
/usr/include/jansson.h	2

Fuzzer: fuzz_pem_key

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	215	37.0%
gold	[1:9]	117	20.1%
yellow	[10:29]	25	4.31%
greenyellow	[30:49]	68	11.7%
lawngreen	50+	155	26.7%
All colors	580	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
13	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
11	398	cjose_jwk_create_RSA_spec	call site: 00398	cjose_err_message
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
7	333	cjose_base64url_encode	call site: 00333	cjose_err_message
7	390	cjose_jwk_create_RSA_spec	call site: 00390	BN_bin2bn
5	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	544	oidc_jwk_to_json	call site: 00544	_oidc_jose_error_set
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached

Runtime coverage analysis

Covered functions

111

Functions that are reachable but not covered

139

Reachable functions

227

Percentage of reachable functions covered

38.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_pem_key.c	3
mod_auth_openidc/test/util.c	5
mod_auth_openidccfg/cfg.c	8
mod_auth_openidc/test/stub.c	3
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	17
cjosejwk.c	15
cjoseutil.c	3
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	13
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	2
mod_auth_openidcutil/base64.c	2
mod_auth_openidcjose.c	3
cjosebase64.c	2
cjoseerror.c	1
/usr/include/jansson.h	3
mod_auth_openidcjson.c	2

Fuzzer: fuzz_jwks

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	265	33.6%
gold	[1:9]	199	25.2%
yellow	[10:29]	17	2.15%
greenyellow	[30:49]	7	0.88%
lawngreen	50+	300	38.0%
All colors	788	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	634	_oidc_jwk_rsa_key_to_jwk	call site: 00634	_oidc_jwk_ec_key_to_jwk
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
13	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
4	242	oidc_jwk_parse	call site: 00242	cjose_err_message
4	277	_cjose_jwk_decode_json_object_base64url_attribute	call site: 00277	_cjose_base64_decode_impl
4	525	oidc_jwk_new	call site: 00525	_oidc_jose_error_set
3	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy

Runtime coverage analysis

Covered functions

146

Functions that are reachable but not covered

147

Reachable functions

266

Percentage of reachable functions covered

44.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_jwks.c	3
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	8
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	26
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	2
mod_auth_openidcjson.c	7
/usr/include/jansson.h	4
mod_auth_openidcjose.c	4
cjoseerror.c	1
cjosebase64.c	4

Fuzzer: fuzz_strings

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	29.2%
gold	[1:9]	106	25.1%
yellow	[10:29]	1	0.23%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	191	45.3%
All colors	421	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
5	341	oidc_http_hdr_in_get	call site: 00341	ap_log_rerror_
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
4	356	oidc_jose_hash_bytes	call site: 00356	_oidc_jose_error_set
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached
3	127	oidc_cache_mutex_global_create	call site: 00127	ap_log_error_
3	131	oidc_cache_mutex_global_create	call site: 00131	ap_log_error_
3	337	oidc_state_browser_fingerprint	call site: 00337	oidc_http_hdr_in_x_forwarded_for_get

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

108

Reachable functions

198

Percentage of reachable functions covered

45.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_strings.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	10
mod_auth_openidc/test/stub.c	7
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	6
mod_auth_openidc./const.h	9
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	17
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcutil/html.c	5
mod_auth_openidcutil/util.c	10
mod_auth_openidcproto/jwt.c	1
mod_auth_openidcutil/base64.c	3
mod_auth_openidcjson.c	8
/usr/include/jansson.h	2
mod_auth_openidcstate.c	1
mod_auth_openidcjose.c	2

Fuzzer: fuzz_discovery_response

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3271	81.2%
gold	[1:9]	105	2.60%
yellow	[10:29]	5	0.12%
greenyellow	[30:49]	6	0.14%
lawngreen	50+	638	15.8%
All colors	4025	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
707	3316	oidc_request_authenticate_user	call site: 03316	oidc_discovery_response_authenticate
580	1631	oidc_proto_profile_ops	call site: 01631	oidc_cfg_provider_signed_jwks_uri_set
507	2478	oidc_proto_request_auth_params_set	call site: 02478	oidc_proto_request_object_param_add
350	1072	oidc_http_query_encoded_url	call site: 01072	oidc_http_request
198	2987	oidc_proto_profile_auth_request_method_get	call site: 02987	oidc_proto_request_auth_push
140	910	oidc_util_jwt_verify	call site: 00910	oidc_metadata_provider_retrieve
102	3201	oidc_response_post_preserve_javascript	call site: 03201	oidc_original_request_method
60	1570	oidc_util_jwt_create	call site: 01570	oidc_metadata_provider_parse
53	568	oidc_util_base64url_encode	call site: 00568	oidc_cache_crypto_decrypt
33	452	oidc_validate_redirect_url	call site: 00452	oidc_validate_redirect_url_allowed
33	1425	oidc_json_encode	call site: 01425	oidc_cache_set
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config

Runtime coverage analysis

Covered functions

251

Functions that are reachable but not covered

747

Reachable functions

977

Percentage of reachable functions covered

23.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_discovery_response.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	43
mod_auth_openidc/test/stub.c	13
mod_auth_openidccfg/provider.c	144
mod_auth_openidcjose/jwk.c	27
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	17
mod_auth_openidc./const.h	9
mod_auth_openidccfg/dir.c	7
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	3
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	17
mod_auth_openidchttp.c	56
mod_auth_openidchandle/discovery.c	10
mod_auth_openidcutil/url.c	12
mod_auth_openidcutil/util.c	20
mod_auth_openidcutil/html.c	10
mod_auth_openidcmod_auth_openidc.c	9
mod_auth_openidcutil/expr.c	1
mod_auth_openidcutil/pcre_subst.c	4
mod_auth_openidcjose.c	18
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	5
mod_auth_openidcjson.c	42
/usr/include/jansson.h	4
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
cjoseheader.c	3
mod_auth_openidcjose/jws.c	13
mod_auth_openidc./metrics.h	1
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	16
mod_auth_openidcproto/proto.c	4
cjosejws.c	15
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	13
mod_auth_openidchandle/request.c	9
mod_auth_openidcutil/request_state.c	3
mod_auth_openidcutil/random.c	3
mod_auth_openidcproto/state.c	24
mod_auth_openidcstate.c	7
mod_auth_openidcproto/request.c	4
mod_auth_openidcproto/request_object.c	14
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/auth.c	10
mod_auth_openidchandle/response.c	1
mod_auth_openidcutil/file.c	4
mod_auth_openidcproto/discovery.c	4
mod_auth_openidcmetadata.c	1
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6

Fuzzer: fuzz_metadata

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	564	39.1%
gold	[1:9]	131	9.10%
yellow	[10:29]	22	1.52%
greenyellow	[30:49]	27	1.87%
lawngreen	50+	695	48.2%
All colors	1439	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
160	757	oidc_jwk_new	call site: 00757	oidc_jwk_pkey_to_jwk
44	533	_cjose_jwk_decode_private_attribute	call site: 00533	cjose_jwk_create_EC_spec
40	670	_cjose_jwk_import_OKP	call site: 00670	cjose_jwk_create_OKP_spec
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
23	733	_oidc_jwk_parse_x5c_spec	call site: 00733	_oidc_jwk_parse_x5c
14	961	oidc_cfg_provider_signed_jwks_uri_keys_set	call site: 00961	oidc_jwk_copy
13	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
8	495	_cjose_jwk_import_EC	call site: 00495	_cjose_jwk_decode_json_object_base64url_attribute
8	1362	oidc_metadata_conf_parse_tls_client	call site: 01362	oidc_cfg_parse_filename
7	235	oidc_metadata_provider_is_valid	call site: 00235	ap_log_rerror_
7	928	oidc_jwk_parse	call site: 00928	json_array_size

Runtime coverage analysis

Covered functions

264

Functions that are reachable but not covered

243

Reachable functions

478

Percentage of reachable functions covered

49.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_metadata.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	13
mod_auth_openidc/test/stub.c	6
mod_auth_openidccfg/provider.c	135
mod_auth_openidcjose/jwk.c	24
cjosejwk.c	32
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	2
mod_auth_openidcjson.c	24
/usr/include/jansson.h	2
mod_auth_openidcmetadata/provider.c	5
mod_auth_openidcutil/util.c	3
mod_auth_openidcmetadata/util.c	10
mod_auth_openidcproto/proto.c	2
mod_auth_openidcproto/profile.c	8
mod_auth_openidcjose.c	11
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcmetadata/conf.c	14
mod_auth_openidcmetadata/client.c	3

Fuzzer: fuzz_authz_response

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3268	68.4%
gold	[1:9]	164	3.43%
yellow	[10:29]	28	0.58%
greenyellow	[30:49]	21	0.43%
lawngreen	50+	1294	27.0%
All colors	4775	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
398	1611	oidc_http_request	call site: 01611	oidc_metadata_provider_parse
295	2584	oidc_get_provider_for_issuer	call site: 02584	oidc_metadata_get
289	2040	oidc_cfg_endpoint_auth_is_mtls	call site: 02040	oidc_cfg_provider_signed_jwks_uri_set
227	2356	oidc_jose_get_string	call site: 02356	oidc_jwks_parse_json
196	4267	oidc_userinfo_retrieve_claims	call site: 04267	oidc_refresh_token_grant
131	2880	oidc_proto_profile_id_token_aud_values_get	call site: 02880	oidc_metadata_conf_parse_response
115	3141	oidc_util_url_cur_host	call site: 03141	oidc_util_url_redirect_uri
103	3693	oidc_proto_jwt_validate	call site: 03693	oidc_proto_jwks_uri_keys
75	3961	oidc_proto_endpoint_client_secret_basic	call site: 03961	oidc_proto_endpoint_auth_client_secret_jwt
55	3571	oidc_jwt_alg2kty	call site: 03571	oidc_proto_jwks_uri_keys
52	3267	oidc_json_object_iter_next	call site: 03267	oidc_http_post_json
51	4121	oidc_proto_token_endpoint_call	call site: 04121	oidc_proto_token_endpoint_dpop_retry

Runtime coverage analysis

Covered functions

473

Functions that are reachable but not covered

674

Reachable functions

1105

Percentage of reachable functions covered

39.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_authz_response.c	7
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	50
mod_auth_openidc/test/stub.c	13
mod_auth_openidccfg/provider.c	145
mod_auth_openidcjose/jwk.c	28
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	9
mod_auth_openidccfg/dir.c	7
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	17
mod_auth_openidchttp.c	63
mod_auth_openidcproto/state.c	29
mod_auth_openidcjson.c	45
mod_auth_openidcstate.c	7
mod_auth_openidcjose.c	22
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jws.c	15
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
/usr/include/jansson.h	4
cjoseheader.c	3
cjosejws.c	15
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcutil/util.c	23
mod_auth_openidcsession.c	56
mod_auth_openidcutil/random.c	4
mod_auth_openidcproto/jwt.c	9
mod_auth_openidc./metrics.h	2
mod_auth_openidcutil/url.c	8
mod_auth_openidcutil/request_state.c	3
mod_auth_openidchandle/response.c	15
mod_auth_openidcutil/html.c	10
mod_auth_openidcmod_auth_openidc.c	5
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	16
mod_auth_openidcproto/proto.c	3
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	12
mod_auth_openidcmetadata.c	1
mod_auth_openidcutil/file.c	4
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6
mod_auth_openidcproto/response.c	16
mod_auth_openidcproto/id_token.c	12
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/token.c	8
mod_auth_openidcproto/auth.c	10
mod_auth_openidcproto/dpop.c	2
mod_auth_openidchandle/userinfo.c	2
mod_auth_openidcproto/userinfo.c	7
mod_auth_openidchandle/refresh.c	7
mod_auth_openidcutil/expr.c	2
mod_auth_openidcutil/pcre_subst.c	5

Fuzzer: fuzz_post_preserve

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	293	62.3%
gold	[1:9]	103	21.9%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	74	15.7%
All colors	470	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
77	252	oidc_http_hdr_in_get	call site: 00252	_oidc_util_url_cur_port
39	401	oidc_response_post_preserve_javascript	call site: 00401	oidc_util_html_send_in_template
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
25	226	oidc_original_request_method	call site: 00226	oidc_util_url_redirect_uri
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
17	447	oidc_util_html_javascript_escape	call site: 00447	oidc_util_template_escape
9	382	oidc_util_read_form_encoded_params_impl	call site: 00382	oidc_util_userdata_set_post_param
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
5	332	oidc_http_url_decode	call site: 00332	ap_log_rerror_
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_

Runtime coverage analysis

Covered functions

68

Functions that are reachable but not covered

138

Reachable functions

198

Percentage of reachable functions covered

30.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_post_preserve.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	13
mod_auth_openidc/test/stub.c	11
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	6
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	5
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	15
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidchandle/response.c	1
mod_auth_openidcmod_auth_openidc.c	1
mod_auth_openidcutil/url.c	11
mod_auth_openidcutil/util.c	10
mod_auth_openidchandle/discovery.c	1
mod_auth_openidcutil/html.c	8
mod_auth_openidcutil/file.c	3
mod_auth_openidcutil/request_state.c	2

Fuzzer: fuzz_cookie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	271	40.6%
gold	[1:9]	93	13.9%
yellow	[10:29]	3	0.44%
greenyellow	[30:49]	3	0.44%
lawngreen	50+	297	44.5%
All colors	667	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
43	330	_oidc_jose_error_set	call site: 00330	oidc_jwk_set_or_generate_kid
21	150	_oidc_str_to_int_checked	call site: 00150	oidc_cache_mutex_post_config
15	579	oidc_util_url_cur_is_secure	call site: 00579	oidc_http_hdr_forwarded_get
13	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
12	512	oidc_alg2kty	call site: 00512	cjose_jwe_decrypt
9	458	_cjose_header_validate_crit	call site: 00458	cjose_err_message
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	141	oidc_cfg_post_config	call site: 00141	_oidc_metrics_shm_size
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
5	496	_cjose_jwe_validate_enc	call site: 00496	cjose_jwe_release

Runtime coverage analysis

Covered functions

139

Functions that are reachable but not covered

128

Reachable functions

255

Percentage of reachable functions covered

49.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_cookie.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	15
mod_auth_openidc/test/stub.c	5
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	6
cjosejwk.c	6
cjoseutil.c	5
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	5
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	18
mod_auth_openidcutil/util.c	3
mod_auth_openidcstate.c	5
mod_auth_openidcproto/state.c	5
mod_auth_openidcutil/jwt.c	2
mod_auth_openidcproto/jwt.c	1
mod_auth_openidcutil/base64.c	2
mod_auth_openidcjson.c	9
/usr/include/jansson.h	2
cjoseerror.c	1
mod_auth_openidcjose.c	6
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	4
cjosejwe.c	13
cjoseheader.c	3
mod_auth_openidcjose/jws.c	1
mod_auth_openidcutil/url.c	2

Fuzzer: fuzz_bearer_token

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1927	62.6%
gold	[1:9]	154	5.00%
yellow	[10:29]	83	2.69%
greenyellow	[30:49]	38	1.23%
lawngreen	50+	876	28.4%
All colors	3078	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
396	1318	oidc_oauth_provider_config	call site: 01318	oidc_oauth_metadata_provider_retrieve
239	2403	oidc_jwt_verify	call site: 02403	oidc_metadata_jwks_retrieve_and_cache
220	2643	cjose_const_memcmp	call site: 02643	oidc_proto_jwks_uri_keys
195	1871	oidc_oauth_get_cached_access_token	call site: 01871	oidc_oauth_introspect
77	671	oidc_util_url_redirect_uri	call site: 00671	_oidc_util_url_base_cur
56	1746	oidc_json_array_get	call site: 01746	oidc_metadata_cert_bound_tokens_enabled
56	2303	oidc_jwt_alg2kty	call site: 02303	oidc_proto_jwks_uri_keys
42	2918	oidc_get_remote_user	call site: 02918	oidc_util_regexp_first_match
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
27	762	oidc_cache_mutex_lock	call site: 00762	oidc_cache_mutex_unlock
24	1719	oidc_json_object_get_string	call site: 01719	oidc_metadata_endpoint_auth_select
18	238	oidc_util_base64url_decode	call site: 00238	oidc_cfg_parse_is_valid_option

Runtime coverage analysis

Covered functions

348

Functions that are reachable but not covered

449

Reachable functions

761

Percentage of reachable functions covered

41.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_bearer_token.c	8
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	34
mod_auth_openidc/test/stub.c	15
mod_auth_openidccfg/provider.c	12
mod_auth_openidcjose/jwk.c	22
cjosejwk.c	34
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	36
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	14
mod_auth_openidc./const.h	9
mod_auth_openidccfg/dir.c	13
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	17
mod_auth_openidchttp.c	52
mod_auth_openidcutil/base64.c	3
cjoseerror.c	1
mod_auth_openidcjose.c	11
cjosebase64.c	4
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcjson.c	40
/usr/include/jansson.h	4
mod_auth_openidcjose/jws.c	13
cjosejws.c	15
cjoseheader.c	3
mod_auth_openidcoauth.c	30
mod_auth_openidcutil/util.c	21
mod_auth_openidcutil/url.c	11
mod_auth_openidc./metrics.h	1
mod_auth_openidcmod_auth_openidc.c	5
mod_auth_openidchandle/revoke.c	1
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	7
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
mod_auth_openidcmetadata/oauth.c	1
mod_auth_openidcproto/profile.c	3
mod_auth_openidcmetadata/util.c	6
mod_auth_openidcproto/proto.c	2
mod_auth_openidcutil/request_state.c	6
mod_auth_openidcproto/auth.c	10
mod_auth_openidcutil/random.c	3
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcutil/expr.c	2
mod_auth_openidcutil/pcre_subst.c	5
mod_auth_openidcutil/appinfo.c	9

Fuzzer: fuzz_current_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	116	36.2%
gold	[1:9]	93	29.0%
yellow	[10:29]	1	0.31%
greenyellow	[30:49]	1	0.31%
lawngreen	50+	109	34.0%
All colors	320	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
9	223	oidc_check_x_forwarded_hdr	call site: 00223	oidc_util_spaced_string_to_hashtable
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached
3	127	oidc_cache_mutex_global_create	call site: 00127	ap_log_error_
3	131	oidc_cache_mutex_global_create	call site: 00131	ap_log_error_
2	67	oidc_test_request_init	call site: 00067	oidc_cfg_provider_authorization_endpoint_url_valid

Runtime coverage analysis

Covered functions

74

Functions that are reachable but not covered

82

Reachable functions

148

Percentage of reachable functions covered

44.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_current_url.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	12
mod_auth_openidc/test/stub.c	7
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	6
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	10
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcutil/url.c	11
mod_auth_openidcutil/util.c	3

Fuzzer: fuzz_response_header

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	45.7%
gold	[1:9]	99	44.3%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	22	9.86%
All colors	223	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
20	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup
3	105	oidc_test_crypto_passphrase_derive_keys_cached	call site: 00105	oidc_test_key_derive_cached
3	127	oidc_cache_mutex_global_create	call site: 00127	ap_log_error_
3	131	oidc_cache_mutex_global_create	call site: 00131	ap_log_error_
3	215	oidc_http_response_header	call site: 00215	fprintf
2	67	oidc_test_request_init	call site: 00067	oidc_cfg_provider_authorization_endpoint_url_valid

Runtime coverage analysis

Covered functions

47

Functions that are reachable but not covered

72

Reachable functions

111

Percentage of reachable functions covered

35.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_response_header.c	2
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	8
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	3
cjosejwk.c	1
cjoseutil.c	1
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	8
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	3

Fuzzer: fuzz_state_cookie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	226	39.5%
gold	[1:9]	169	29.5%
yellow	[10:29]	4	0.69%
greenyellow	[30:49]	6	1.04%
lawngreen	50+	167	29.1%
All colors	572	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
43	279	_oidc_jose_error_set	call site: 00279	oidc_jwk_set_or_generate_kid
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
13	43	cjose_jwk_release	call site: 00043	oidc_cfg_oauth_destroy
9	407	_cjose_header_validate_crit	call site: 00407	cjose_err_message
9	461	oidc_alg2kty	call site: 00461	_oidc_jose_error_set
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
5	36	oidc_cfg_server_alloc	call site: 00036	oidc_cfg_server_destroy
5	76	_oidc_strnatcasecmp	call site: 00076	_oidc_strnatcasecmp
5	179	oidc_cfg_parse_option	call site: 00179	oidc_cfg_parse_options_flatten
5	445	_cjose_jwe_validate_enc	call site: 00445	cjose_jwe_release
4	136	oidc_cache_mutex_global_create	call site: 00136	ap_log_error_
4	192	oidc_http_curl_pool_init	call site: 00192	oidc_http_curl_pool_cleanup

Runtime coverage analysis

Covered functions

127

Functions that are reachable but not covered

118

Reachable functions

233

Percentage of reachable functions covered

49.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_state_cookie.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	9
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	6
cjosejwk.c	6
cjoseutil.c	5
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	2
mod_auth_openidcproto/state.c	17
mod_auth_openidcutil/jwt.c	2
mod_auth_openidcproto/jwt.c	1
mod_auth_openidcutil/base64.c	2
mod_auth_openidcjson.c	13
/usr/include/jansson.h	2
cjoseerror.c	1
mod_auth_openidcjose.c	6
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	4
cjosejwe.c	13
cjoseheader.c	3
mod_auth_openidcjose/jws.c	1

Fuzzer: fuzz_jwt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	523	50.1%
gold	[1:9]	209	20.0%
yellow	[10:29]	52	4.99%
greenyellow	[30:49]	8	0.76%
lawngreen	50+	250	23.9%
All colors	1042	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	590	_cjose_base64_encode_impl	call site: 00590	oidc_jwk_pkey_to_jwk
69	515	oidc_jwk_new	call site: 00515	oidc_jwk_pem_bio_read_public
30	141	oidc_cfg_post_config	call site: 00141	oidc_cache_mutex_post_config
30	425	_cjose_jwk_import_oct	call site: 00425	_cjose_jwk_import_OKP
30	484	oidc_jose_get_string	call site: 00484	_oidc_jwk_parse_x5c
16	934	oidc_jwt_parse	call site: 00934	oidc_jose_uncompress
15	456	cjose_const_memcmp	call site: 00456	_cjose_jwk_OKP_new
9	205	oidc_json_parse	call site: 00205	ap_log_rerror_
9	298	cjose_jwk_create_EC_spec	call site: 00298	cjose_err_message
9	760	_cjose_header_validate_crit	call site: 00760	cjose_err_message
8	116	oidc_cache_mutex_global_create	call site: 00116	ap_log_error_
7	686	oidc_jwk_parse	call site: 00686	json_array_size

Runtime coverage analysis

Covered functions

161

Functions that are reachable but not covered

181

Reachable functions

314

Percentage of reachable functions covered

42.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_jwt.c	3
mod_auth_openidc/test/util.c	6
mod_auth_openidccfg/cfg.c	8
mod_auth_openidc/test/stub.c	4
mod_auth_openidccfg/provider.c	7
mod_auth_openidcjose/jwk.c	19
cjosejwk.c	31
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	1
mod_auth_openidccfg/parse.c	5
mod_auth_openidc./const.h	7
mod_auth_openidccfg/dir.c	3
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	1
mod_auth_openidccache/common.c	4
mod_auth_openidcmetrics.c	5
mod_auth_openidchttp.c	2
mod_auth_openidcjson.c	7
/usr/include/jansson.h	2
mod_auth_openidcjose.c	9
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jws.c	11
mod_auth_openidcjose/jwe.c	4
cjosejwe.c	13
cjoseheader.c	3
cjosejws.c	12
cjoseversion.c	1

Fuzzer: fuzz_redirect_uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4148	79.6%
gold	[1:9]	346	6.64%
yellow	[10:29]	44	0.84%
greenyellow	[30:49]	38	0.72%
lawngreen	50+	630	12.1%
All colors	5206	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
543	1892	oidc_cfg_endpoint_auth_is_mtls	call site: 01892	oidc_cfg_provider_signed_jwks_uri_set
418	3395	oidc_jwt_parse	call site: 03395	oidc_proto_jwt_verify
360	2508	oidc_util_rand_str	call site: 02508	oidc_metadata_conf_parse
325	1535	_oidc_strcasecmp	call site: 01535	oidc_metadata_provider_parse
295	4375	oidc_refresh_token_grant_obtain_tokens	call site: 04375	oidc_proto_userinfo_request
257	4056	oidc_proto_token_endpoint_call	call site: 04056	oidc_userinfo_retrieve_claims
204	2998	oidc_util_url_cur_host	call site: 02998	oidc_http_post_json
126	3843	oidc_proto_endpoint_client_secret_basic	call site: 03843	oidc_proto_endpoint_auth_client_secret_jwt
89	5114	oidc_util_read_post_params_impl	call site: 05114	oidc_metadata_list
80	4915	oidc_session_get_idtoken	call site: 04915	oidc_session_save
69	1464	oidc_http_request	call site: 01464	oidc_http_response_header
68	2436	oidc_get_provider_for_issuer	call site: 02436	oidc_metadata_get

Runtime coverage analysis

Covered functions

474

Functions that are reachable but not covered

843

Reachable functions

1192

Percentage of reachable functions covered

29.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c	2
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	55
mod_auth_openidc/test/stub.c	18
mod_auth_openidccfg/provider.c	145
mod_auth_openidcjose/jwk.c	28
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	10
mod_auth_openidccfg/dir.c	15
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	30
mod_auth_openidchttp.c	66
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcsession.c	70
mod_auth_openidcjson.c	46
/usr/include/jansson.h	4
mod_auth_openidcutil/random.c	4
mod_auth_openidcutil/util.c	24
mod_auth_openidcjose.c	22
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	9
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
cjoseheader.c	3
mod_auth_openidcjose/jws.c	15
mod_auth_openidc./metrics.h	2
cjosejws.c	15
mod_auth_openidcutil/url.c	13
mod_auth_openidcutil/request_state.c	3
mod_auth_openidcmod_auth_openidc.c	10
mod_auth_openidchandle/response.c	15
mod_auth_openidcstate.c	7
mod_auth_openidcproto/state.c	18
mod_auth_openidcutil/html.c	12
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	17
mod_auth_openidcproto/proto.c	3
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	12
mod_auth_openidcmetadata.c	2
mod_auth_openidcutil/file.c	4
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6
mod_auth_openidcproto/response.c	16
mod_auth_openidcproto/id_token.c	12
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/token.c	8
mod_auth_openidcproto/auth.c	10
mod_auth_openidcproto/dpop.c	2
mod_auth_openidchandle/userinfo.c	3
mod_auth_openidcproto/userinfo.c	7
mod_auth_openidchandle/refresh.c	10
mod_auth_openidcutil/expr.c	3
mod_auth_openidcutil/pcre_subst.c	5
mod_auth_openidchandle/content.c	3
mod_auth_openidchandle/info.c	6
mod_auth_openidcutil/appinfo.c	5
mod_auth_openidchandle/dpop.c	1
mod_auth_openidchandle/jwks.c	1
mod_auth_openidchandle/discovery.c	6

Fuzzer: fuzz_backchannel_logout

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3240	75.0%
gold	[1:9]	196	4.54%
yellow	[10:29]	34	0.78%
greenyellow	[30:49]	81	1.87%
lawngreen	50+	765	17.7%
All colors	4316	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
399	3913	oidc_logout	call site: 03913	oidc_logout_build_op_request
327	1455	_oidc_strcasecmp	call site: 01455	oidc_metadata_provider_parse
320	1783	oidc_proto_profile_ops	call site: 01783	oidc_cfg_provider_signed_jwks_uri_set
298	2360	oidc_get_provider_for_issuer	call site: 02360	oidc_metadata_get
260	2659	oidc_proto_profile_id_token_aud_values_get	call site: 02659	oidc_metadata_client_get
231	2128	oidc_jose_get_string	call site: 02128	oidc_jwks_parse_json
189	1264	oidc_json_array_get	call site: 01264	oidc_metadata_provider_retrieve
178	2925	oidc_util_url_cur_host	call site: 02925	oidc_http_post_json
176	3113	oidc_json_array_has_value	call site: 03113	oidc_logout_revoke_one_token
101	3641	oidc_proto_validate_iat	call site: 03641	oidc_proto_jwks_uri_keys
54	3517	oidc_jwt_alg2kty	call site: 03517	oidc_proto_jwks_uri_keys
32	1114	oidc_session_save	call site: 01114	oidc_session_save_cookie

Runtime coverage analysis

Covered functions

331

Functions that are reachable but not covered

713

Reachable functions

1012

Percentage of reachable functions covered

29.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c	4
mod_auth_openidc/test/util.c	7
mod_auth_openidccfg/cfg.c	44
mod_auth_openidc/test/stub.c	13
mod_auth_openidccfg/provider.c	145
mod_auth_openidcjose/jwk.c	28
cjosejwk.c	35
cjoseutil.c	6
mod_auth_openidccfg/oauth.c	2
mod_auth_openidccfg/cache.c	2
mod_auth_openidccfg/parse.c	16
mod_auth_openidc./const.h	9
mod_auth_openidccfg/dir.c	6
mod_auth_openidcconst.h	2
mod_auth_openidcutil/key.c	6
mod_auth_openidccache/common.c	14
mod_auth_openidcmetrics.c	17
mod_auth_openidchttp.c	63
mod_auth_openidc/test/fuzz/fuzz.h	1
mod_auth_openidcjson.c	43
/usr/include/jansson.h	4
mod_auth_openidcjose.c	18
cjoseerror.c	1
cjosebase64.c	4
mod_auth_openidcjose/jws.c	15
cjosejws.c	15
cjoseheader.c	3
mod_auth_openidcsession.c	44
mod_auth_openidcutil/random.c	4
mod_auth_openidcutil/util.c	20
mod_auth_openidcutil/base64.c	3
mod_auth_openidcutil/jwt.c	5
mod_auth_openidcproto/jwt.c	9
mod_auth_openidcjose/jwe.c	5
cjosejwe.c	22
mod_auth_openidc./metrics.h	1
mod_auth_openidcutil/url.c	9
mod_auth_openidcutil/request_state.c	3
mod_auth_openidchandle/logout.c	20
mod_auth_openidcmod_auth_openidc.c	11
mod_auth_openidcmetadata/provider.c	7
mod_auth_openidcmetadata/util.c	16
mod_auth_openidcproto/proto.c	3
mod_auth_openidc./cfg/cfg_int.h	2
mod_auth_openidcproto/profile.c	13
mod_auth_openidcmetadata.c	1
mod_auth_openidcutil/file.c	4
mod_auth_openidcmetadata/conf.c	19
mod_auth_openidcmetadata/client.c	6
mod_auth_openidcproto/auth.c	10
mod_auth_openidchandle/response.c	1
mod_auth_openidcutil/html.c	2
mod_auth_openidcproto/jwks.c	4
mod_auth_openidcmetadata/jwks.c	8
cjoseversion.c	1
mod_auth_openidcproto/id_token.c	8
mod_auth_openidcutil/expr.c	1
mod_auth_openidcutil/pcre_subst.c	4
mod_auth_openidchandle/refresh.c	7
mod_auth_openidcproto/token.c	8
mod_auth_openidcproto/dpop.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
oidc_register_hooks	/src/mod_auth_openidc/src/mod_auth_openidc.c	1	['N/A']	19	0	23	3	2	1441	0	10737	745
oidc_authz_24_checker_claim	/src/mod_auth_openidc/src/handle/authz.c	3	['N/A', 'N/A', 'N/A']	24	0	21	3	2	768	0	5638	261
_cjose_jwe_encrypt_ek_ecdh_es_a256kw	/src/cjose/src/jwe.c	4	['N/A', 'N/A', 'N/A', 'N/A']	6	0	24	3	2	66	0	368	157
oidc_cache_file_set	/src/mod_auth_openidc/src/cache/file.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	6	0	511	84	28	46	0	285	147
oidc_session_management	/src/mod_auth_openidc/src/handle/session_management.c	3	['N/A', 'N/A', 'N/A']	22	0	783	143	49	969	0	6527	103
oidc_cache_shm_set	/src/mod_auth_openidc/src/cache/shm.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'size_t']	5	0	417	61	21	55	0	183	84
_cjose_jwe_decrypt_dat_aes_cbc	/src/cjose/src/jwe.c	2	['N/A', 'N/A']	4	0	700	108	37	28	0	126	78

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1360 / 1807

Cyclomatic complexity statically reachable by fuzzers

11626 / 14208

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

mod_auth_openidc/test/fuzz/fuzz_url.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_util_regexp_first_match', 'oidc_cache_mutex_global_create', 'oidc_util_strcasestr', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_validate_redirect_url_host', 'oidc_http_hdr_in_get']

mod_auth_openidc/test/fuzz/fuzz_base64.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_form_params.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_util_read_form_encoded_params_impl', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_pem_key.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'cjose_jwk_release', 'cjose_jwk_create_RSA_spec', 'oidc_cache_mutex_global_create', 'cjose_base64url_encode', 'oidc_cfg_server_alloc', '_oidc_strnatcasecmp', 'oidc_jwk_to_json']

mod_auth_openidc/test/fuzz/fuzz_jwks.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_jwk_rsa_key_to_jwk', 'oidc_cfg_post_config', 'cjose_jwk_release', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_jwk_parse', '_cjose_jwk_decode_json_object_base64url_attribute']

mod_auth_openidc/test/fuzz/fuzz_strings.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', 'oidc_cfg_parse_option', 'oidc_http_hdr_in_get', 'oidc_http_curl_pool_init', 'oidc_jose_hash_bytes', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_discovery_response.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_request_authenticate_user', 'oidc_proto_profile_ops', 'oidc_proto_request_auth_params_set', 'oidc_http_query_encoded_url', 'oidc_proto_profile_auth_request_method_get', 'oidc_util_jwt_verify', 'oidc_response_post_preserve_javascript', 'oidc_util_jwt_create', 'oidc_util_base64url_encode', 'oidc_validate_redirect_url']

mod_auth_openidc/test/fuzz/fuzz_metadata.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_jwk_new', '_cjose_jwk_decode_private_attribute', '_cjose_jwk_import_OKP', 'oidc_cfg_post_config', '_oidc_jwk_parse_x5c_spec', 'oidc_cfg_provider_signed_jwks_uri_keys_set', 'cjose_jwk_release', 'oidc_cache_mutex_global_create', '_cjose_jwk_import_EC', 'oidc_metadata_conf_parse_tls_client']

mod_auth_openidc/test/fuzz/fuzz_authz_response.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_http_request', 'oidc_get_provider_for_issuer', 'oidc_cfg_endpoint_auth_is_mtls', 'oidc_jose_get_string', 'oidc_userinfo_retrieve_claims', 'oidc_proto_profile_id_token_aud_values_get', 'oidc_util_url_cur_host', 'oidc_proto_jwt_validate', 'oidc_proto_endpoint_client_secret_basic', 'oidc_jwt_alg2kty']

mod_auth_openidc/test/fuzz/fuzz_post_preserve.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_http_hdr_in_get', 'oidc_response_post_preserve_javascript', 'oidc_cfg_post_config', 'oidc_original_request_method', 'oidc_cfg_server_alloc', 'oidc_util_html_javascript_escape', 'oidc_util_read_form_encoded_params_impl', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option']

mod_auth_openidc/test/fuzz/fuzz_cookie.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_jose_error_set', '_oidc_str_to_int_checked', 'oidc_util_url_cur_is_secure', 'cjose_jwk_release', 'oidc_alg2kty', '_cjose_header_validate_crit', 'oidc_cache_mutex_global_create', 'oidc_cfg_server_alloc', '_oidc_strnatcasecmp', 'oidc_cfg_post_config']

mod_auth_openidc/test/fuzz/fuzz_bearer_token.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_oauth_provider_config', 'oidc_jwt_verify', 'cjose_const_memcmp', 'oidc_oauth_get_cached_access_token', 'oidc_util_url_redirect_uri', 'oidc_json_array_get', 'oidc_jwt_alg2kty', 'oidc_get_remote_user', 'oidc_cfg_post_config', 'oidc_cache_mutex_lock']

mod_auth_openidc/test/fuzz/fuzz_current_url.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_check_x_forwarded_hdr', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_response_header.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_post_config', 'oidc_cfg_server_alloc', 'oidc_cache_mutex_global_create', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', 'oidc_http_curl_pool_init', 'oidc_test_crypto_passphrase_derive_keys_cached']

mod_auth_openidc/test/fuzz/fuzz_state_cookie.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_oidc_jose_error_set', 'oidc_cfg_post_config', 'cjose_jwk_release', '_cjose_header_validate_crit', 'oidc_alg2kty', 'oidc_cache_mutex_global_create', 'oidc_cfg_server_alloc', '_oidc_strnatcasecmp', 'oidc_cfg_parse_option', '_cjose_jwe_validate_enc']

mod_auth_openidc/test/fuzz/fuzz_jwt.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cjose_base64_encode_impl', 'oidc_jwk_new', 'oidc_cfg_post_config', '_cjose_jwk_import_oct', 'oidc_jose_get_string', 'oidc_jwt_parse', 'cjose_const_memcmp', 'oidc_json_parse', 'cjose_jwk_create_EC_spec', '_cjose_header_validate_crit']

mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_cfg_endpoint_auth_is_mtls', 'oidc_jwt_parse', 'oidc_util_rand_str', '_oidc_strcasecmp', 'oidc_refresh_token_grant_obtain_tokens', 'oidc_proto_token_endpoint_call', 'oidc_util_url_cur_host', 'oidc_proto_endpoint_client_secret_basic', 'oidc_util_read_post_params_impl', 'oidc_session_get_idtoken']

mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['oidc_logout', '_oidc_strcasecmp', 'oidc_proto_profile_ops', 'oidc_get_provider_for_issuer', 'oidc_proto_profile_id_token_aud_values_get', 'oidc_jose_get_string', 'oidc_json_array_get', 'oidc_util_url_cur_host', 'oidc_json_array_has_value', 'oidc_proto_validate_iat']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
cjose_jwk_to_json	69	35	50.72%	['fuzz_backchannel_logout', 'fuzz_pem_key', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token', 'fuzz_jwks']
_cjose_jwk_RSA_private_fields	34	16	47.05%	['fuzz_pem_key', 'fuzz_jwks']
_cjose_header_validate_crit	47	10	21.27%	['fuzz_backchannel_logout', 'fuzz_cookie', 'fuzz_discovery_response', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
cjose_jwe_encrypt_multi_iv	101	35	34.65%	['fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
_cjose_jwe_encrypt_dat_aes_gcm	86	34	39.53%	['fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
_cjose_jwe_validate_decrypt_key	31	14	45.16%	['fuzz_backchannel_logout', 'fuzz_cookie', 'fuzz_discovery_response', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
oidc_request_check_cookie_domain	39	21	53.84%	['fuzz_redirect_uri', 'fuzz_discovery_response']
oidc_provider_static_config	38	8	21.05%	['fuzz_redirect_uri', 'fuzz_discovery_response', 'fuzz_backchannel_logout', 'fuzz_authz_response']
cjose_jws_sign	46	14	30.43%	['fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
_cjose_jws_build_dig_hmac_sha	85	41	48.23%	['fuzz_backchannel_logout', 'fuzz_bearer_token', 'fuzz_jwt', 'fuzz_authz_response']
_cjose_jws_validate_verify_key	47	25	53.19%	['fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_jwt', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
oidc_response_proto_state_restore	41	21	51.21%	['fuzz_redirect_uri', 'fuzz_authz_response']
oidc_userinfo_retrieve_claims	66	15	22.72%	['fuzz_redirect_uri', 'fuzz_authz_response']
oidc_http_request	102	23	22.54%	['fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
oidc_proto_token_endpoint_auth	41	10	24.39%	['fuzz_backchannel_logout', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_bearer_token']
oidc_proto_idtoken_validate_aud_array	36	17	47.22%	['fuzz_redirect_uri', 'fuzz_backchannel_logout', 'fuzz_authz_response']
oidc_proto_jwt_verify	53	27	50.94%	['fuzz_redirect_uri', 'fuzz_bearer_token', 'fuzz_backchannel_logout', 'fuzz_authz_response']
oidc_proto_resolve_code_and_validate_response	40	18	45.0%	['fuzz_redirect_uri', 'fuzz_authz_response']
oidc_util_set_trace_parent	54	14	25.92%	['fuzz_redirect_uri', 'fuzz_bearer_token', 'fuzz_backchannel_logout', 'fuzz_authz_response']
oidc_state_cookies_delete_oldest	31	8	25.80%	['fuzz_redirect_uri', 'fuzz_discovery_response', 'fuzz_cookie', 'fuzz_authz_response']
oidc_oauth_parse_and_cache_token_expiry	39	12	30.76%	['fuzz_bearer_token']
_cjose_jwe_decrypt_dat_aes_cbc	85	38	44.70%	['fuzz_jwt']
_cjose_jws_build_dig_sha	77	41	53.24%	['fuzz_jwt']
oidc_dpop_request	59	19	32.20%	['fuzz_redirect_uri']
oidc_info_request	46	21	45.65%	['fuzz_redirect_uri']
oidc_logout_revoke_tokens	32	16	50.0%	['fuzz_redirect_uri', 'fuzz_backchannel_logout']
oidc_logout_cleanup_by_sid	33	17	51.51%	['fuzz_redirect_uri', 'fuzz_backchannel_logout']
oidc_refresh_token_grant	36	16	44.44%	['fuzz_redirect_uri', 'fuzz_backchannel_logout', 'fuzz_authz_response']
oidc_refresh_token_cache_get	46	24	52.17%	['fuzz_redirect_uri', 'fuzz_backchannel_logout', 'fuzz_authz_response']
oidc_handle_existing_session	49	15	30.61%	['fuzz_redirect_uri']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/mod_auth_openidc/src/http.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/dpop.c	['fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/src/metadata/jwks.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/src/cache/file.c	[]	[]
/src/mod_auth_openidc/test/fuzz/fuzz_authz_response.c	['fuzz_authz_response']	['fuzz_authz_response']
/src/mod_auth_openidc/src/cfg/provider.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/session.c	['fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/response.c	['fuzz_authz_response', 'fuzz_redirect_uri']	['fuzz_authz_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/./const.h	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/src/handle/userinfo.c	['fuzz_authz_response', 'fuzz_redirect_uri']	['fuzz_authz_response']
/src/mod_auth_openidc/src/proto/request_object.c	['fuzz_discovery_response']	[]
/src/mod_auth_openidc/src/handle/request.c	['fuzz_discovery_response']	['fuzz_discovery_response']
/src/mod_auth_openidc/src/handle/session_management.c	[]	[]
/src/cjose/src/header.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/util/pcre_subst.c	['fuzz_url', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url']
/src/mod_auth_openidc/src/handle/request_uri.c	[]	[]
/src/mod_auth_openidc/src/proto/profile.c	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/jose.c	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_base64.c	['fuzz_base64']	['fuzz_base64']
/src/mod_auth_openidc/src/metadata/conf.c	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_metadata']
/src/mod_auth_openidc/src/proto/jwks.c	['fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/cjose/src/util.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/util/jwt.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/util/html.c	['fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/auth.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_authz_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/metadata.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/src/oauth.c	['fuzz_bearer_token']	['fuzz_bearer_token']
/src/mod_auth_openidc/src/metadata/client.c	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_metadata']
/src/mod_auth_openidc/src/util/url.c	['fuzz_url', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/cjose/src/concatkdf.c	[]	[]
/src/mod_auth_openidc/src/util/base64.c	['fuzz_base64', 'fuzz_pem_key', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_base64', 'fuzz_pem_key', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/util/request_state.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/cfg/cfg.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/usr/include/jansson.h	['fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/cjose/src/jws.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/cfg/cache.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/jose/jwk.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/handle/response.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_post_preserve.c	['fuzz_post_preserve']	['fuzz_post_preserve']
/src/cjose/src/base64.c	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz.h	['fuzz_strings', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_strings', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/cfg/parse.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_json.c	['fuzz_json']	['fuzz_json']
/src/mod_auth_openidc/src/handle/dpop.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/cfg/check.c	[]	[]
/src/mod_auth_openidc/test/fuzz/fuzz_strings.c	['fuzz_strings']	['fuzz_strings']
/src/mod_auth_openidc/src/util/expr.c	['fuzz_url', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_form_params.c	['fuzz_form_params']	['fuzz_form_params']
/src/mod_auth_openidc/src/metadata/util.c	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_metadata']
/src/mod_auth_openidc/src/util/file.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/src/proto/request.c	['fuzz_discovery_response']	['fuzz_discovery_response']
/src/mod_auth_openidc/src/metadata/oauth.c	['fuzz_bearer_token']	[]
/src/mod_auth_openidc/src/proto/userinfo.c	['fuzz_authz_response', 'fuzz_redirect_uri']	[]
/src/mod_auth_openidc/test/util.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/id_token.c	['fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_authz_response', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/handle/jwks.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/./metrics.h	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/src/handle/discovery.c	['fuzz_discovery_response', 'fuzz_post_preserve', 'fuzz_redirect_uri']	['fuzz_discovery_response', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/handle/authz.c	[]	[]
/src/mod_auth_openidc/src/proto/proto.c	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_bearer_token', 'fuzz_redirect_uri']
/src/mod_auth_openidc/src/jose/jwe.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_response_header.c	['fuzz_response_header']	['fuzz_response_header']
/src/mod_auth_openidc/src/metadata/provider.c	['fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_metadata']
/src/mod_auth_openidc/src/metrics.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/test/fuzz/fuzz_discovery_response.c	['fuzz_discovery_response']	['fuzz_discovery_response']
/src/mod_auth_openidc/src/util/util.c	['fuzz_url', 'fuzz_form_params', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_form_params', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_pem_key.c	['fuzz_pem_key']	['fuzz_pem_key']
/src/mod_auth_openidc/src/state.c	['fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_redirect_uri']	['fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_jwt.c	['fuzz_jwt']	['fuzz_jwt']
/src/cjose/src/error.c	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/pkce.c	[]	[]
/src/mod_auth_openidc/src/handle/revoke.c	['fuzz_bearer_token']	[]
/src/mod_auth_openidc/test/fuzz/fuzz_jwks.c	['fuzz_jwks']	['fuzz_jwks']
/src/mod_auth_openidc/src/cache/shm.c	[]	[]
/src/mod_auth_openidc/src/util/key.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/util/random.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/jwt.c	['fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_strings', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/state.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_state_cookie', 'fuzz_redirect_uri']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_state_cookie', 'fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_current_url.c	['fuzz_current_url']	['fuzz_current_url']
/src/mod_auth_openidc/src/util/appinfo.c	['fuzz_bearer_token', 'fuzz_redirect_uri']	['fuzz_bearer_token']
/src/cjose/src/jwk.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_pem_key', 'fuzz_jwks', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_metadata.c	['fuzz_metadata']	['fuzz_metadata']
/src/mod_auth_openidc/test/fuzz/fuzz_state_cookie.c	['fuzz_state_cookie']	['fuzz_state_cookie']
/src/mod_auth_openidc/src/cache/memcache.c	[]	[]
/src/cjose/src/jwe.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_redirect_uri.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/test/fuzz/fuzz_url.c	['fuzz_url']	['fuzz_url']
/src/mod_auth_openidc/test/fuzz/fuzz_cookie.c	['fuzz_cookie']	['fuzz_cookie']
/src/mod_auth_openidc/src/proto/discovery.c	['fuzz_discovery_response']	[]
/src/mod_auth_openidc/src/cfg/oauth.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/handle/content.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/handle/info.c	['fuzz_redirect_uri']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/cfg/dir.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/fuzz/fuzz_bearer_token.c	['fuzz_bearer_token']	['fuzz_bearer_token']
/src/mod_auth_openidc/test/fuzz/fuzz_backchannel_logout.c	['fuzz_backchannel_logout']	['fuzz_backchannel_logout']
/src/mod_auth_openidc/src/cache/common.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/proto/token.c	['fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_authz_response', 'fuzz_redirect_uri']
/src/cjose/src/version.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_bearer_token', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_bearer_token', 'fuzz_jwt', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/handle/logout.c	['fuzz_backchannel_logout']	['fuzz_backchannel_logout']
/src/mod_auth_openidc/src/handle/refresh.c	['fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_redirect_uri']
/src/mod_auth_openidc/src/mod_auth_openidc.c	['fuzz_url', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_bearer_token', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/test/stub.c	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_url', 'fuzz_base64', 'fuzz_form_params', 'fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_post_preserve', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_current_url', 'fuzz_response_header', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/jose/jws.c	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']
/src/mod_auth_openidc/src/./cfg/cfg_int.h	['fuzz_discovery_response', 'fuzz_authz_response', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	[]
/src/mod_auth_openidc/src/json.c	['fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']	['fuzz_json', 'fuzz_pem_key', 'fuzz_jwks', 'fuzz_strings', 'fuzz_discovery_response', 'fuzz_metadata', 'fuzz_authz_response', 'fuzz_cookie', 'fuzz_bearer_token', 'fuzz_state_cookie', 'fuzz_jwt', 'fuzz_redirect_uri', 'fuzz_backchannel_logout']

Directories in report

Directory
/src/mod_auth_openidc/src/cfg/
/src/mod_auth_openidc/src/jose/
/usr/include/
/src/mod_auth_openidc/test/
/src/mod_auth_openidc/src/
/src/mod_auth_openidc/src/cache/
/src/mod_auth_openidc/src/./
/src/mod_auth_openidc/src/util/
/src/mod_auth_openidc/src/handle/
/src/mod_auth_openidc/src/proto/
/src/mod_auth_openidc/src/metadata/
/src/cjose/src/
/src/mod_auth_openidc/src/./cfg/
/src/mod_auth_openidc/test/fuzz/