High level conclusions

Fuzzers reach 66.74% of cyclomatic complexity.

Fuzzers reach 59.63% of all functions.

Fuzzer snmp_parse_fuzzer is blocked:

The runtime code coverage of snmp_parse_fuzzer covers 21.90% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_scoped_pdu_parse_fuzzer is blocked:

The runtime code coverage of snmp_scoped_pdu_parse_fuzzer covers 27.27% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_parse_oid_fuzzer is blocked:

The runtime code coverage of snmp_parse_oid_fuzzer covers 27.65% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_transport_fuzzer is blocked:

The runtime code coverage of snmp_transport_fuzzer covers 22.65% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_config_fuzzer is blocked:

The runtime code coverage of snmp_config_fuzzer covers 25.30% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer read_objid_fuzzer is blocked:

The runtime code coverage of read_objid_fuzzer covers 25.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1291 / 2165

Cyclomatic complexity statically reachable by fuzzers

12783 / 19151

Runtime code coverage of functions

876 / 2165

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: snmp_config_mem_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	880	84.9%
gold	[1:9]	69	6.66%
yellow	[10:29]	6	0.57%
greenyellow	[30:49]	5	0.48%
lawngreen	50+	76	7.33%
All colors	1036	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
566	374	strlcpy	call site: 00374	parse_compliance
92	198	find_tree_node	call site: 00198	parse_imports
67	129	print_error	call site: 00129	do_linkup
38	962	snmp_set_detail	call site: 00962	parse_octet_hint
30	98	init_tree_roots	call site: 00098	read_from_file
19	354	print_module_not_found	call site: 00354	read_module_replacements
18	328	netsnmp_ds_set_string	call site: 00328	netsnmp_set_mib_directory
13	948	_add_strings_to_oid	call site: 00948	find_tree_node
6	48	read_config_read_octet_string_const	call site: 00048	debugmsgtoken
6	317	netsnmp_set_mib_directory	call site: 00317	debugmsgtoken
5	5	copy_nword_const	call site: 00005	debugmsg
5	16	log_handler_stdouterr	call site: 00016	sprintf_stamp

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

101

Reachable functions

150

Percentage of reachable functions covered

32.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_config_mem_fuzzer.c	1
snmplib/read_config.c	11
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/default_store.c	4
snmplib/mib.c	15
snmplib/parse.c	63
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1
snmplib/int64.c	5

Fuzzer: parse_octet_hint_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	75.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	7	21.8%
lawngreen	50+	1	3.12%
All colors	32	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	7	parse_hints_ctor	call site: 00007	parse_hints_parse

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

9

Reachable functions

13

Percentage of reachable functions covered

30.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/parse_octet_hint_fuzzer.c	1
snmplib/mib.c	6

Fuzzer: read_objid_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	872	89.2%
gold	[1:9]	64	6.55%
yellow	[10:29]	2	0.20%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	39	3.99%
All colors	977	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
566	334	strlcpy	call site: 00334	parse_compliance
92	158	find_tree_node	call site: 00158	parse_imports
67	89	print_error	call site: 00089	do_linkup
38	922	snmp_set_detail	call site: 00922	parse_octet_hint
19	69	snmp_log	call site: 00069	parse
19	314	print_module_not_found	call site: 00314	read_module_replacements
18	288	netsnmp_ds_set_string	call site: 00288	netsnmp_set_mib_directory
13	908	_add_strings_to_oid	call site: 00908	find_tree_node
11	57	init_tree_roots	call site: 00057	read_from_file
6	277	netsnmp_set_mib_directory	call site: 00277	debugmsgtoken
5	17	which_module	call site: 00017	debugmsg
5	28	log_handler_stdouterr	call site: 00028	sprintf_stamp

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

99

Reachable functions

132

Percentage of reachable functions covered

25.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/read_objid_fuzzer.c	1
snmplib/mib.c	15
snmplib/parse.c	63
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/default_store.c	4
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1

Fuzzer: snmp_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	974	80.3%
gold	[1:9]	20	1.65%
yellow	[10:29]	3	0.24%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	215	17.7%
All colors	1212	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
594	375	netsnmp_ds_set_string	call site: 00375	read_module_replacements
200	152	read_mib	call site: 00152	netsnmp_read_module
45	105	get_token	call site: 00105	parseQuoteString
18	353	netsnmp_getenv	call site: 00353	netsnmp_set_mib_directory
17	45	register_mib_handlers	call site: 00045	debugmsgtoken
16	64	register_mib_handlers	call site: 00064	debugmsgtoken
16	976	netsnmp_ds_register_premib	call site: 00976	netsnmp_ds_parse_boolean
16	996	config_vlog	call site: 00996	copy_nword
7	1019	skip_white_const	call site: 01019	netsnmp_ds_set_string
5	14	internal_register_config_handler	call site: 00014	debugmsg
5	25	log_handler_stdouterr	call site: 00025	sprintf_stamp
5	93	snmp_log	call site: 00093	snmp_log

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

121

Reachable functions

162

Percentage of reachable functions covered

25.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_config_fuzzer.c	1
snmplib/mib.c	8
snmplib/read_config.c	21
snmplib/default_store.c	9
snmplib/strlcpy.c	1
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/parse.c	64
snmplib/tools.c	2
snmplib/strlcat.c	1

Fuzzer: snmp_print_var_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1069	76.5%
gold	[1:9]	107	7.65%
yellow	[10:29]	38	2.72%
greenyellow	[30:49]	17	1.21%
lawngreen	50+	166	11.8%
All colors	1397	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
566	358	strlcpy	call site: 00358	parse_compliance
85	189	module_name	call site: 00189	parse_imports
67	113	print_error	call site: 00113	do_linkup
48	1303	sprint_realloc_integer	call site: 01303	netsnmp_sprint_realloc_objid_tree
38	946	snmp_set_detail	call site: 00946	parse_octet_hint
19	93	snmp_log	call site: 00093	parse
19	338	print_module_not_found	call site: 00338	read_module_replacements
18	312	netsnmp_ds_set_string	call site: 00312	netsnmp_set_mib_directory
13	1045	sprint_realloc_by_type	call site: 01045	sprint_realloc_asciistring
11	81	init_tree_roots	call site: 00081	read_from_file
10	1027	_get_realloc_symbol	call site: 01027	_get_realloc_symbol_octet_string
9	936	_add_strings_to_oid	call site: 00936	find_tree_node

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

108

Reachable functions

184

Percentage of reachable functions covered

41.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_print_var_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	5
snmplib/default_store.c	5
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/mib.c	49
snmplib/parse.c	64
snmplib/tools.c	3
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5

Fuzzer: snmp_transport_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1233	78.4%
gold	[1:9]	59	3.75%
yellow	[10:29]	30	1.90%
greenyellow	[30:49]	8	0.50%
lawngreen	50+	241	15.3%
All colors	1571	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
662	203	netsnmp_tlsbase_ctor	call site: 00203	netsnmp_certs_load
358	953	netsnmp_tdomain_dump	call site: 00953	sprint_realloc_objid
22	919	netsnmp_alias_ctor	call site: 00919	copy_nword
21	1327	netsnmp_ipv6_fmtaddr	call site: 01327	netsnmp_gethostbyaddr
18	124	init_snmp_transport	call site: 00124	netsnmp_transport_filter_add
16	76	config_vlog	call site: 00076	copy_nword
15	56	netsnmp_ds_register_config	call site: 00056	netsnmp_ds_parse_boolean
11	1397	netsnmp_getaddrinfo	call site: 01397	debugmsgtoken
10	99	skip_white_const	call site: 00099	netsnmp_ds_handle_config
8	114	init_snmp_transport	call site: 00114	netsnmp_ds_set_int
6	166	netsnmp_tlsbase_ctor	call site: 00166	copy_nword
5	4	netsnmp_ds_set_string	call site: 00004	debugmsg

Runtime coverage analysis

Covered functions

71

Functions that are reachable but not covered

239

Reachable functions

309

Percentage of reachable functions covered

22.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_transport_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	4
snmplib/default_store.c	9
snmplib/snmp_debug.c	5
snmplib/snmp_logging.c	6
snmplib/snmp_transport.c	11
snmplib/read_config.c	15
snmplib/strlcpy.c	1
snmplib/container.c	9
snmplib/transports/snmpTLSBaseDomain.c	4
snmplib/snmp_openssl.c	9
snmplib/callback.c	5
snmplib/cert_util.c	40
snmplib/tools.c	6
snmplib/system.c	4
snmplib/snmp_enum.c	8
snmplib/dir_utils.c	3
snmplib/file_utils.c	5
snmplib/data_list.c	4
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/snmp_api.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	3
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	6
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	2
snmplib/mib.c	30
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/transports/snmpIPv6BaseDomain.c	7
snmplib/transports/snmpIPBaseDomain.c	2

Fuzzer: snmp_mib_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	14.6%
gold	[1:9]	88	9.63%
yellow	[10:29]	21	2.30%
greenyellow	[30:49]	14	1.53%
lawngreen	50+	656	71.8%
All colors	913	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	761	parse_capabilities	call site: 00761	eat_syntax
18	316	netsnmp_ds_set_string	call site: 00316	netsnmp_set_mib_directory
7	165	do_linkup	call site: 00165	dump_module_list
6	52	print_error	call site: 00052	debugmsgtoken
6	100	new_module	call site: 00100	debugmsgtoken
6	305	netsnmp_set_mib_directory	call site: 00305	debugmsgtoken
5	18	log_handler_stdouterr	call site: 00018	sprintf_stamp
5	29	snmp_vlog	call site: 00029	snmp_log
5	36	read_mib	call site: 00036	debugmsg
5	189	module_name	call site: 00189	debugmsgtoken
4	7	read_mib	call site: 00007	snmp_log_perror
4	232	do_subtree	call site: 00232	debugmsgtoken

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

40

Reachable functions

120

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_mib_fuzzer.c	1
snmplib/parse.c	64
snmplib/snmp_logging.c	7
snmplib/default_store.c	4
snmplib/snmp_debug.c	4
snmplib/mib.c	3
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1

Fuzzer: snmp_e2e_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4480	76.5%
gold	[1:9]	774	13.2%
yellow	[10:29]	119	2.03%
greenyellow	[30:49]	27	0.46%
lawngreen	50+	453	7.73%
All colors	5853	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1230	4510	_snmp_parse	call site: 04510	snmp_sess_send
568	1971	print_module_not_found	call site: 01971	read_module_replacements
139	2932	snmp_set_detail	call site: 02932	usm_set_user_password
126	1786	read_module_internal	call site: 01786	read_from_file
102	418	_get_cert_container	call site: 00418	netsnmp_directory_container_read_some
97	3695	netsnmp_parse_args	call site: 03695	netsnmp_container_init_list
93	1050	sprint_realloc_hexstring	call site: 01050	sprint_realloc_bitstring
84	1579	init_snmp_logging	call site: 01579	snmp_log_options
83	1226	netsnmp_sprint_realloc_objid_tree	call site: 01226	sprint_realloc_counter64
79	521	se_find_slist_ptr	call site: 00521	_add_certfile
66	665	_netsnmp_release_trustcerts	call site: 00665	_find_partner
64	1149	printI64	call site: 01149	netsnmp_sprint_realloc_objid_tree

Runtime coverage analysis

Covered functions

313

Functions that are reachable but not covered

484

Reachable functions

778

Percentage of reachable functions covered

37.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_e2e_fuzzer.c	2
snmplib/snmp_parse_args.c	3
snmplib/snmp_api.c	77
snmplib/parse.c	72
snmplib/snmp_debug.c	18
snmplib/snmp_logging.c	26
snmplib/default_store.c	11
snmplib/mib.c	42
snmplib/snmp_transport.c	20
snmplib/transports/snmpTLSBaseDomain.c	4
snmplib/snmp_openssl.c	9
snmplib/read_config.c	45
snmplib/strlcpy.c	1
snmplib/callback.c	7
snmplib/cert_util.c	44
snmplib/tools.c	11
snmplib/system.c	3
snmplib/snmp_enum.c	13
snmplib/dir_utils.c	3
snmplib/container.c	18
snmplib/file_utils.c	5
snmplib/data_list.c	4
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	1
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	1
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp_service.c	10
snmplib/snmp_version.c	1
snmplib/container_binary_array.c	21
snmplib/container_list_ssll.c	1
snmplib/container_null.c	2
snmplib/strlcat.c	1
snmplib/snmpv3.c	24
snmplib/lcd_time.c	4
snmplib/scapi.c	13
snmplib/snmp_secmod.c	4
snmplib/snmpusm.c	26
snmplib/keytools.c	5
snmplib/snmptsm.c	1
snmplib/snmpksm.c	2
snmplib/snmp_alarm.c	11
snmplib/vacm.c	1
snmplib/large_fd_set.c	9
snmplib/snmp.c	4
snmplib/asn1.c	51
snmplib/snmp_auth.c	1
snmplib/snmp_client.c	10

Fuzzer: snmp_parse_oid_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	882	87.5%
gold	[1:9]	64	6.34%
yellow	[10:29]	2	0.19%
greenyellow	[30:49]	2	0.19%
lawngreen	50+	58	5.75%
All colors	1008	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
566	345	strlcpy	call site: 00345	parse_compliance
92	169	find_tree_node	call site: 00169	parse_imports
67	100	print_error	call site: 00100	do_linkup
38	933	snmp_set_detail	call site: 00933	parse_octet_hint
19	80	snmp_log	call site: 00080	parse
19	325	print_module_not_found	call site: 00325	read_module_replacements
18	299	netsnmp_ds_set_string	call site: 00299	netsnmp_set_mib_directory
13	919	_add_strings_to_oid	call site: 00919	find_tree_node
11	68	init_tree_roots	call site: 00068	read_from_file
8	4	snmp_parse_oid	call site: 00004	debugmsgtoken
6	288	netsnmp_set_mib_directory	call site: 00288	debugmsgtoken
5	18	log_handler_stdouterr	call site: 00018	sprintf_stamp

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

102

Reachable functions

141

Percentage of reachable functions covered

27.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_oid_fuzzer.c	1
snmplib/mib.c	19
snmplib/default_store.c	4
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/parse.c	65
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1

Fuzzer: agentx_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	577	39.2%
gold	[1:9]	9	0.61%
yellow	[10:29]	59	4.01%
greenyellow	[30:49]	49	3.33%
lawngreen	50+	775	52.7%
All colors	1469	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
335	294	agentx_parse_oid	call site: 00294	sprint_realloc_objid
22	6	agentx_parse_header	call site: 00006	debugmsg
17	49	snmp_realloc	call site: 00049	debugmsg
10	195	agentx_parse_string	call site: 00195	debugmsg
8	653	snmp_set_var_value	call site: 00653	snmp_log
8	1255	agentx_realloc_build_varbind	call site: 01255	debug_indent_add
7	1377	agentx_realloc_build_varbind	call site: 01377	debugmsgtoken
6	646	snmp_varlist_add_variable	call site: 00646	snmp_log
6	1304	agentx_realloc_build_float	call site: 01304	debug_indent_add
6	1328	agentx_realloc_build_double	call site: 01328	debug_indent_add
6	1353	agentx_realloc_build_varbind	call site: 01353	debug_indent_add
6	1369	agentx_realloc_build_varbind	call site: 01369	debug_indent_add

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

88

Reachable functions

129

Percentage of reachable functions covered

31.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/agentx_parse_fuzzer.c	1
agent/mibgroup/agentx/protocol.c	22
snmplib/snmp_debug.c	8
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/mib.c	30
snmplib/tools.c	2
snmplib/snmp_client.c	4
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp_api.c	11
snmplib/strlcpy.c	1
snmplib/snmp_secmod.c	1
snmplib/snmpusm.c	1
snmplib/container.c	2

Fuzzer: snmp_scoped_pdu_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	95	70.8%
gold	[1:9]	13	9.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.49%
lawngreen	50+	24	17.9%
All colors	134	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	57	asn_parse_string	call site: 00057	debugmsg_hex
22	27	snmpv3_scopedPDU_parse	call site: 00027	debugmsg
14	110	snmpv3_scopedPDU_parse	call site: 00110	asn_parse_string
3	126	snmp_free_pdu	call site: 00126	snmp_log
2	53	snmpv3_scopedPDU_parse	call site: 00053	snmp_log
2	131	snmp_free_pdu	call site: 00131	snmp_free_var
1	4	asn_parse_sequence	call site: 00004	snmp_set_detail
1	13	asn_parse_nlength	call site: 00013	snmp_set_detail

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

40

Reachable functions

55

Percentage of reachable functions covered

27.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_scoped_pdu_parse_fuzzer.c	1
snmplib/snmp_api.c	7
snmplib/asn1.c	8
snmplib/strlcpy.c	1
snmplib/snmp_debug.c	7
snmplib/snmp_logging.c	6
snmplib/default_store.c	2
snmplib/mib.c	4
snmplib/tools.c	2
snmplib/snmp_secmod.c	1

Fuzzer: snmp_api_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1953	54.7%
gold	[1:9]	121	3.39%
yellow	[10:29]	90	2.52%
greenyellow	[30:49]	118	3.30%
lawngreen	50+	1284	36.0%
All colors	3566	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
585	1148	print_module_not_found	call site: 01148	read_module_replacements
325	305	find_tree_node	call site: 00305	_get_realloc_symbol
189	3202	snmp_pdu_realloc_rbuild	call site: 03202	snmpv3_packet_build
149	935	print_error	call site: 00935	parse_imports
81	2660	snmpv3_parse	call site: 02660	snmp_pdu_parse
69	3470	_snmp_build	call site: 03470	snmp_build
64	2773	_snmp_parse	call site: 02773	snmp_sess_send
51	1741	_add_strings_to_oid	call site: 01741	parse_octet_hint
45	2844	_snmp_build	call site: 02844	snmpv3_packet_realloc_rbuild
45	3156	snmp_pdu_realloc_rbuild	call site: 03156	asn_realloc_rbuild_objid
30	899	init_tree_roots	call site: 00899	read_from_file
25	2745	_snmp_parse	call site: 02745	snmp_call_callbacks

Runtime coverage analysis

Covered functions

161

Functions that are reachable but not covered

191

Reachable functions

348

Percentage of reachable functions covered

45.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_api_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	7
agent/mibgroup/agentx/protocol.c	11
snmplib/snmp_debug.c	10
snmplib/snmp_logging.c	7
snmplib/default_store.c	5
snmplib/mib.c	50
snmplib/tools.c	8
snmplib/snmp_client.c	11
snmplib/parse.c	66
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	9
snmplib/snmp_api.c	43
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/asn1.c	50
snmplib/snmp.c	4
snmplib/snmp_secmod.c	1
snmplib/snmp_auth.c	1
snmplib/callback.c	4
snmplib/snmpv3.c	3
snmplib/snmp_enum.c	4
snmplib/snmp_transport.c	2

Fuzzer: snmp_pdu_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	429	61.6%
gold	[1:9]	4	0.57%
yellow	[10:29]	22	3.16%
greenyellow	[30:49]	15	2.15%
lawngreen	50+	226	32.4%
All colors	696	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
183	91	asn_parse_objid	call site: 00091	sprint_realloc_objid
157	275	snmp_log	call site: 00275	netsnmp_sprint_realloc_objid_tree
22	61	asn_parse_objid	call site: 00061	debugmsg
7	451	asn_parse_string	call site: 00451	debugmsg
5	24	snmp_pdu_parse	call site: 00024	debugmsg
5	35	log_handler_stdouterr	call site: 00035	sprintf_stamp
3	563	snmp_pdu_parse	call site: 00563	_asn_size_err
3	584	asn_parse_unsigned_int64	call site: 00584	debugmsg
3	588	snmp_pdu_parse	call site: 00588	_asn_size_err
3	606	snmp_pdu_parse	call site: 00606	_asn_size_err
3	626	snmp_pdu_parse	call site: 00626	_asn_size_err
3	648	asn_parse_signed_int64	call site: 00648	debugmsg

Runtime coverage analysis

Covered functions

41

Functions that are reachable but not covered

75

Reachable functions

115

Percentage of reachable functions covered

34.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_pdu_parse_fuzzer.c	1
snmplib/snmp_api.c	10
snmplib/asn1.c	18
snmplib/strlcpy.c	1
snmplib/snmp_debug.c	8
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/mib.c	30
snmplib/tools.c	3
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp.c	1
snmplib/snmp_client.c	1
snmplib/snmp_secmod.c	1

Fuzzer: snmp_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1647	79.5%
gold	[1:9]	15	0.72%
yellow	[10:29]	19	0.91%
greenyellow	[30:49]	19	0.91%
lawngreen	50+	370	17.8%
All colors	2070	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1121	947	_snmp_parse	call site: 00947	snmp_sess_send
334	301	asn_parse_objid	call site: 00301	sprint_realloc_objid
55	223	snmpv3_parse	call site: 00223	snmp_pdu_parse
27	847	snmp_free_var	call site: 00847	snmp_pdu_parse
22	81	asn_parse_int	call site: 00081	debugmsg
12	187	asn_parse_string	call site: 00187	debugmsg
11	887	snmp_get_next_transid	call site: 00887	snmp_parse_version
5	4	snmpv3_parse	call site: 00004	debugmsg
5	15	log_handler_stdouterr	call site: 00015	sprintf_stamp
5	910	_snmp_parse	call site: 00910	debugmsgtoken
3	723	snmp_pdu_parse	call site: 00723	_asn_size_err
3	744	asn_parse_unsigned_int64	call site: 00744	debugmsg

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

164

Reachable functions

210

Percentage of reachable functions covered

21.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_fuzzer.c	1
snmplib/snmp_api.c	38
snmplib/snmp_debug.c	10
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/asn1.c	50
snmplib/strlcpy.c	1
snmplib/mib.c	30
snmplib/tools.c	4
snmplib/snmp_secmod.c	1
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp.c	4
snmplib/snmp_client.c	10
snmplib/snmp_auth.c	1
snmplib/callback.c	4
snmplib/snmpv3.c	2
snmplib/snmp_enum.c	4
snmplib/snmp_transport.c	2

Fuzzer: snmp_agent_e2e_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8051	73.7%
gold	[1:9]	153	1.40%
yellow	[10:29]	142	1.30%
greenyellow	[30:49]	60	0.54%
lawngreen	50+	2504	22.9%
All colors	10910	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1190	7388	init_agent	call site: 07388	subagent_init
971	4988	_asn_size_err	call site: 04988	send_enterprise_trap_vars
418	6581	read_objid	call site: 06581	netsnmp_register_table_data_set
345	8898	snmp_pdu_parse	call site: 08898	agentx_synch_input
250	81	find_tree_node	call site: 00081	_get_realloc_symbol
233	1176	_get_cert_container	call site: 01176	_add_certfile
227	9247	snmp_unregister_callback	call site: 09247	subagent_shutdown
178	4297	read_configs	call site: 04297	init_snmp
133	1488	netsnmp_certs_load	call site: 01488	netsnmp_cert_load_x509
128	10451	init_vacm_conf	call site: 10451	vacm_in_view
109	9626	_init_tlstmCertToTSN	call site: 09626	netsnmp_certToTSN_parse_common
103	3762	read_config_read_octet_string_const	call site: 03762	usm_set_user_password

Runtime coverage analysis

Covered functions

602

Functions that are reachable but not covered

859

Reachable functions

1419

Percentage of reachable functions covered

39.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_agent_e2e_fuzzer.c	3
testing/fuzzing/ada_fuzz_header.h	4
agent/snmp_vars.c	6
snmplib/snmp_logging.c	28
snmplib/default_store.c	12
agent/snmp_agent.c	53
snmplib/tools.c	16
snmplib/snmp_debug.c	21
agent/kernel.c	2
agent/agent_registry.c	37
snmplib/snmp_api.c	97
agent/helpers/null.c	3
agent/agent_handler.c	27
snmplib/mib.c	68
snmplib/parse.c	76
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	9
agent/helpers/bulk_to_next.c	4
snmplib/snmp_enum.c	15
snmplib/snmp_client.c	20
snmplib/callback.c	10
agent/agent_read_config.c	8
snmplib/read_config.c	54
snmplib/strlcpy.c	1
agent/agent_trap.c	27
snmplib/snmp_transport.c	30
snmplib/transports/snmpTLSBaseDomain.c	4
snmplib/snmp_openssl.c	10
snmplib/cert_util.c	74
snmplib/system.c	8
snmplib/dir_utils.c	3
snmplib/container.c	23
snmplib/file_utils.c	5
snmplib/data_list.c	8
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	6
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	10
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	7
snmplib/snmp_service.c	14
snmplib/strlcat.c	1
snmplib/snmp_secmod.c	6
snmplib/snmpusm.c	34
snmplib/snmp_parse_args.c	2
snmplib/snmp_version.c	1
snmplib/container_binary_array.c	21
snmplib/container_list_ssll.c	1
snmplib/container_null.c	2
snmplib/snmpv3.c	24
snmplib/lcd_time.c	5
snmplib/scapi.c	15
snmplib/keytools.c	5
snmplib/snmptsm.c	2
snmplib/snmpksm.c	3
snmplib/snmp_alarm.c	15
snmplib/vacm.c	22
snmplib/transports/snmpCallbackDomain.c	9
snmplib/asn1.c	51
snmplib/snmp.c	4
agent/helpers/all_helpers.c	1
agent/helpers/debug_handler.c	4
agent/helpers/serialize.c	3
agent/helpers/read_only.c	3
agent/helpers/table_dataset.c	24
agent/helpers/table_data.c	15
agent/helpers/table.c	13
snmplib/oid_stash.c	7
agent/helpers/row_merge.c	5
agent/helpers/stash_cache.c	10
agent/helpers/cache_handler.c	15
agent/helpers/stash_to_next.c	2
agent/agent_sysORTable.c	10
agent/mibgroup/agentx/agentx_config.c	8
agent/mibgroup/agentx/subagent.c	20
agent/mibgroup/agentx/protocol.c	23
agent/mibgroup/agentx/client.c	9
snmplib/large_fd_set.c	10
snmplib/snmp_auth.c	1
agent/mibgroup/smux/smux.c	5
agent/mibgroup/snmpv3/usmConf.c	1
agent/mibgroup/utilities/iquery.c	7
agent/mibgroup/mibII/vacm_conf.c	29
agent/mibgroup/agentx/master.c	1
snmplib/transports/snmpIPv4BaseDomain.c	3
snmplib/transports/snmpIPBaseDomain.c	2

Fuzzer: snmp_parse_args_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2246	57.6%
gold	[1:9]	735	18.8%
yellow	[10:29]	124	3.18%
greenyellow	[30:49]	59	1.51%
lawngreen	50+	729	18.7%
All colors	3893	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
357	960	netsnmp_tdomain_dump	call site: 00960	sprint_realloc_objid
230	2191	parse_objectid	call site: 02191	parse_compliance
135	735	netsnmp_certs_load	call site: 00735	netsnmp_cert_load_x509
132	2032	get_tc	call site: 02032	merge_parse_objectid
102	420	_get_cert_container	call site: 00420	netsnmp_directory_container_read_some
85	1802	parse	call site: 01802	do_linkup
79	523	se_find_slist_ptr	call site: 00523	_add_certfile
66	667	_netsnmp_release_trustcerts	call site: 00667	_find_partner
60	3391	read_config	call site: 03391	read_config
53	603	snmp_realloc	call site: 00603	_add_cert
50	337	CONTAINER_CLEAR	call site: 00337	netsnmp_directory_container_read_some
48	3832	LLVMFuzzerTestOneInput	call site: 03832	snmp_sess_close

Runtime coverage analysis

Covered functions

342

Functions that are reachable but not covered

313

Reachable functions

637

Percentage of reachable functions covered

50.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_args_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	5
snmplib/snmp_parse_args.c	3
snmplib/snmp_api.c	25
snmplib/parse.c	72
snmplib/snmp_debug.c	13
snmplib/snmp_logging.c	26
snmplib/default_store.c	11
snmplib/mib.c	42
snmplib/snmp_transport.c	15
snmplib/transports/snmpTLSBaseDomain.c	4
snmplib/snmp_openssl.c	9
snmplib/read_config.c	45
snmplib/strlcpy.c	1
snmplib/callback.c	7
snmplib/cert_util.c	44
snmplib/tools.c	10
snmplib/system.c	3
snmplib/snmp_enum.c	13
snmplib/dir_utils.c	3
snmplib/container.c	18
snmplib/file_utils.c	5
snmplib/data_list.c	4
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	1
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	1
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp_service.c	10
snmplib/snmp_version.c	1
snmplib/container_binary_array.c	21
snmplib/container_list_ssll.c	1
snmplib/container_null.c	2
snmplib/strlcat.c	1
snmplib/snmpv3.c	23
snmplib/lcd_time.c	4
snmplib/scapi.c	13
snmplib/snmp_secmod.c	4
snmplib/snmpusm.c	20
snmplib/keytools.c	5
snmplib/snmptsm.c	1
snmplib/snmpksm.c	2
snmplib/snmp_alarm.c	11
snmplib/vacm.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
netsnmp_dtlsudp_close	/src/net-snmp/snmplib/transports/snmpDTLSUDPDomain.c	1	['N/A']	18	0	426	83	23	235	0	1246	643
netsnmp_udpshared_create_tspec	/src/net-snmp/snmplib/transports/snmpUDPsharedDomain.c	1	['N/A']	17	0	82	16	6	131	0	753	384
usm_secmod_process_in_msg	/src/net-snmp/snmplib/snmpusm.c	1	['N/A']	16	0	80	6	3	159	0	1354	370
handle_master_agentx_packet	/src/net-snmp/agent/mibgroup/agentx/master_admin.c	5	['int', 'N/A', 'int', 'N/A', 'N/A']	35	0	494	77	15	818	0	8677	366
smux_accept	/src/net-snmp/agent/mibgroup/smux/smux.c	1	['int']	24	0	391	73	21	315	0	3304	351
usm_secmod_rgenerate_out_msg	/src/net-snmp/snmplib/snmpusm.c	1	['N/A']	15	0	82	6	3	144	0	1199	190
ksm_process_in_msg	/src/net-snmp/snmplib/snmpksm.c	1	['N/A']	8	0	1773	307	89	64	0	322	128

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1477 / 2165

Cyclomatic complexity statically reachable by fuzzers

15013 / 19151

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

testing/fuzzing/snmp_config_mem_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'find_tree_node', 'print_error', 'snmp_set_detail', 'init_tree_roots', 'print_module_not_found', 'netsnmp_ds_set_string', '_add_strings_to_oid', 'read_config_read_octet_string_const', 'netsnmp_set_mib_directory']

testing/fuzzing/parse_octet_hint_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_hints_ctor']

testing/fuzzing/read_objid_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'find_tree_node', 'print_error', 'snmp_set_detail', 'snmp_log', 'print_module_not_found', 'netsnmp_ds_set_string', '_add_strings_to_oid', 'init_tree_roots', 'netsnmp_set_mib_directory']

testing/fuzzing/snmp_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['netsnmp_ds_set_string', 'read_mib', 'get_token', 'netsnmp_getenv', 'register_mib_handlers', 'netsnmp_ds_register_premib', 'config_vlog', 'skip_white_const', 'internal_register_config_handler']

testing/fuzzing/snmp_print_var_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'module_name', 'print_error', 'sprint_realloc_integer', 'snmp_set_detail', 'snmp_log', 'print_module_not_found', 'netsnmp_ds_set_string', 'sprint_realloc_by_type', 'init_tree_roots']

testing/fuzzing/snmp_transport_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['netsnmp_tlsbase_ctor', 'netsnmp_tdomain_dump', 'netsnmp_alias_ctor', 'netsnmp_ipv6_fmtaddr', 'init_snmp_transport', 'config_vlog', 'netsnmp_ds_register_config', 'netsnmp_getaddrinfo', 'skip_white_const']

testing/fuzzing/snmp_mib_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_capabilities', 'netsnmp_ds_set_string', 'do_linkup', 'print_error', 'new_module', 'netsnmp_set_mib_directory', 'log_handler_stdouterr', 'snmp_vlog', 'read_mib', 'module_name']

testing/fuzzing/snmp_e2e_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_snmp_parse', 'print_module_not_found', 'snmp_set_detail', 'read_module_internal', '_get_cert_container', 'netsnmp_parse_args', 'sprint_realloc_hexstring', 'init_snmp_logging', 'netsnmp_sprint_realloc_objid_tree', 'se_find_slist_ptr']

testing/fuzzing/snmp_parse_oid_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'find_tree_node', 'print_error', 'snmp_set_detail', 'snmp_log', 'print_module_not_found', 'netsnmp_ds_set_string', '_add_strings_to_oid', 'init_tree_roots', 'snmp_parse_oid']

testing/fuzzing/agentx_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['agentx_parse_oid', 'agentx_parse_header', 'snmp_realloc', 'agentx_parse_string', 'snmp_set_var_value', 'agentx_realloc_build_varbind', 'snmp_varlist_add_variable', 'agentx_realloc_build_float', 'agentx_realloc_build_double']

testing/fuzzing/snmp_scoped_pdu_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['asn_parse_string', 'snmpv3_scopedPDU_parse', 'snmp_free_pdu', 'asn_parse_sequence', 'asn_parse_nlength']

testing/fuzzing/snmp_api_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['print_module_not_found', 'find_tree_node', 'snmp_pdu_realloc_rbuild', 'print_error', 'snmpv3_parse', '_snmp_build', '_snmp_parse', '_add_strings_to_oid']

testing/fuzzing/snmp_pdu_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['asn_parse_objid', 'snmp_log', 'asn_parse_string', 'snmp_pdu_parse', 'log_handler_stdouterr', 'asn_parse_unsigned_int64']

testing/fuzzing/snmp_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_snmp_parse', 'asn_parse_objid', 'snmpv3_parse', 'snmp_free_var', 'asn_parse_int', 'asn_parse_string', 'snmp_get_next_transid', 'log_handler_stdouterr']

testing/fuzzing/snmp_agent_e2e_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['init_agent', '_asn_size_err', 'read_objid', 'snmp_pdu_parse', 'find_tree_node', '_get_cert_container', 'snmp_unregister_callback', 'read_configs', 'netsnmp_certs_load', 'init_vacm_conf']

testing/fuzzing/snmp_parse_args_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['netsnmp_tdomain_dump', 'parse_objectid', 'netsnmp_certs_load', 'get_tc', '_get_cert_container', 'parse', 'se_find_slist_ptr', '_netsnmp_release_trustcerts', 'read_config', 'snmp_realloc']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
_add_strings_to_oid	365	119	32.60%	['snmp_print_var_fuzzer', 'snmp_parse_oid_fuzzer', 'read_objid_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_config_mem_fuzzer']
parse_octet_hint	87	20	22.98%	['snmp_print_var_fuzzer', 'parse_octet_hint_fuzzer', 'snmp_parse_oid_fuzzer', 'read_objid_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_config_mem_fuzzer']
sprint_realloc_octet_string	232	49	21.12%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_float	37	18	48.64%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_double	37	18	48.64%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_counter64	73	32	43.83%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_opaque	57	20	35.08%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_object_identifier	32	15	46.87%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_timeticks	39	20	51.28%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_integer	60	28	46.66%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_uinteger	55	25	45.45%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_gauge	38	15	39.47%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_bitstring	75	34	45.33%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
_get_realloc_symbol	357	48	13.44%	['agentx_parse_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer']
netsnmp_getaddrinfo	62	26	41.93%	['snmp_agent_e2e_fuzzer', 'snmp_transport_fuzzer']
netsnmp_ipv6_fmtaddr	44	22	50.0%	['snmp_transport_fuzzer']
parse_capabilities	183	100	54.64%	['snmp_print_var_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_parse_oid_fuzzer', 'read_objid_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_config_mem_fuzzer', 'snmp_config_fuzzer']
_certindexes_load	44	22	50.0%	['snmp_parse_args_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_agent_e2e_fuzzer']
_add_certdir	63	14	22.22%	['snmp_parse_args_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_large_fd_set_resize	39	20	51.28%	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
_sess_read	182	33	18.13%	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
_sess_copy	205	101	49.26%	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
_sess_process_packet_parse_pdu	96	38	39.58%	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
_sess_process_packet_handle_pdu	99	21	21.21%	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
register_sec_mod	43	20	46.51%	['snmp_parse_args_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer']
usm_free_user	51	24	47.05%	['agentx_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
usm_create_user_from_session	153	10	6.535%	['snmp_e2e_fuzzer']
usm_session_init	85	33	38.82%	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
setup_engineID	147	57	38.77%	['snmp_parse_args_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
snmp_set_var_value	176	94	53.40%	['agentx_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer']
snmpv3_scopedPDU_parse	49	23	46.93%	['snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer']
asn_build_string	36	17	47.22%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
asn_realloc_rbuild_length	46	17	36.95%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
asn_realloc_rbuild_string	48	19	39.58%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
asn_realloc_rbuild_bitstring	49	18	36.73%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
snmp_pdu_realloc_rbuild	160	66	41.25%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
snmpv3_parse	243	132	54.32%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
snmpv3_build	131	9	6.870%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
_check_range	37	10	27.02%	['snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_register_handler	54	18	33.33%	['snmp_agent_e2e_fuzzer']
netsnmp_call_handler	38	18	47.36%	['snmp_agent_e2e_fuzzer']
netsnmp_subtree_load	128	63	49.21%	['snmp_agent_e2e_fuzzer']
netsnmp_register_mib	126	68	53.96%	['snmp_agent_e2e_fuzzer']
in_a_view	35	5	14.28%	['snmp_agent_e2e_fuzzer']
vacm_parse_view	74	39	52.70%	['snmp_agent_e2e_fuzzer']
handle_snmp_packet	66	24	36.36%	['snmp_agent_e2e_fuzzer']
check_acm	48	26	54.16%	['snmp_agent_e2e_fuzzer']
check_getnext_results	56	10	17.85%	['snmp_agent_e2e_fuzzer']
handle_getnext_loop	62	15	24.19%	['snmp_agent_e2e_fuzzer']
netsnmp_handle_request	61	21	34.42%	['snmp_agent_e2e_fuzzer']
unregister_config_handler	56	22	39.28%	['snmp_agent_e2e_fuzzer']
netsnmp_sd_listen_fds	58	13	22.41%	['snmp_agent_e2e_fuzzer']
_build_initial_pdu_packet	131	10	7.633%	['snmp_api_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer']
netsnmp_sock_buffer_set	53	24	45.28%	['snmp_agent_e2e_fuzzer']
netsnmp_udpipv4base_transport_init	47	18	38.29%	['snmp_agent_e2e_fuzzer']
netsnmp_udpipv4base_transport_bind	49	19	38.77%	['snmp_agent_e2e_fuzzer']
_ssll_insert	44	23	52.27%	['snmp_parse_args_fuzzer']
generate_kul	32	11	34.37%	['snmp_parse_args_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_extend_kul	74	16	21.62%	['snmp_parse_args_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/net-snmp/snmplib/transports/snmpSTDDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPBaseDomain.c	[]	[]
/src/net-snmp/agent/helpers/serialize.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/default_store.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_scoped_pdu_parse_fuzzer.c	['snmp_scoped_pdu_parse_fuzzer']	['snmp_scoped_pdu_parse_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/client.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/agent/agent_sysORTable.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/system.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_parse_args_fuzzer.c	['snmp_parse_args_fuzzer']	['snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/tools.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/mib.c	['snmp_config_mem_fuzzer', 'parse_octet_hint_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'parse_octet_hint_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/vacm.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/usr/include/openssl/x509v3.h	[]	[]
/src/net-snmp/snmplib/transports/snmpTCPIPv6Domain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/strlcpy.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpIPBaseDomain.c	['snmp_transport_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_transport_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/kernel.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/mibgroup/snmpv3/usmConf.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/../include/net-snmp/library/tools.h	['snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	[]
/src/net-snmp/snmplib/data_list.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/mibgroup/utilities/iquery.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPIPv4BaseDomain.c	[]	[]
/src/net-snmp/snmplib/snmpksm.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/container_list_ssll.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/usr/include/openssl/x509.h	[]	[]
/src/net-snmp/agent/helpers/table_dataset.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmptsm.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpUnixDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/snmp_vars.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_parse_oid_fuzzer.c	['snmp_parse_oid_fuzzer']	['snmp_parse_oid_fuzzer']
/src/net-snmp/testing/fuzzing/read_objid_fuzzer.c	['read_objid_fuzzer']	['read_objid_fuzzer']
/src/net-snmp/snmplib/container.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/snmp_logging.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/large_fd_set.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_e2e_fuzzer']
/src/net-snmp/snmplib/asn1.c	['snmp_e2e_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_e2e_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_mib_fuzzer.c	['snmp_mib_fuzzer']	['snmp_mib_fuzzer']
/src/net-snmp/agent/helpers/stash_cache.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/parse.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpIPv4BaseDomain.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/callback.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/protocol.c	['agentx_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_parse_fuzzer', 'snmp_api_fuzzer']
/src/net-snmp/snmplib/cert_util.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/parse_octet_hint_fuzzer.c	['parse_octet_hint_fuzzer']	['parse_octet_hint_fuzzer']
/src/net-snmp/snmplib/snmpv3.c	['snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/read_config.c	['snmp_config_mem_fuzzer', 'snmp_config_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_config_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/master_admin.c	[]	[]
/src/net-snmp/agent/mibgroup/agentx/master.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/agent/helpers/debug_handler.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpTCPBaseDomain.c	[]	[]
/src/net-snmp/snmplib/snmp_client.c	['snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/helpers/cache_handler.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/agent_index.c	[]	[]
/src/net-snmp/agent/helpers/null.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/helpers/stash_to_next.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/sd-daemon.c	[]	[]
/src/net-snmp/snmplib/snmp_service.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/agent_trap.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpSocketBaseDomain.c	[]	[]
/src/net-snmp/snmplib/transports/snmpIPv6BaseDomain.c	['snmp_transport_fuzzer']	['snmp_transport_fuzzer']
/src/net-snmp/snmplib/int64.c	['snmp_config_mem_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_print_var_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer']
/src/net-snmp/snmplib/transports/snmpAAL5PVCDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/snmp_debug.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/subagent.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/agent/agent_registry.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/strlcat.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_mib_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_fuzzer', 'snmp_print_var_fuzzer', 'snmp_mib_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpTCPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/ada_fuzz_header.h	['snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/helpers/row_merge.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/dir_utils.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	[]
/src/net-snmp/snmplib/snmp_openssl.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/snmp_api.c	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_config_mem_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_oid_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/fd_event_manager.c	[]	[]
/src/net-snmp/testing/fuzzing/snmp_e2e_fuzzer.c	['snmp_e2e_fuzzer']	['snmp_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_alarm.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/oid_stash.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/agent/helpers/read_only.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_pdu_parse_fuzzer.c	['snmp_pdu_parse_fuzzer']	['snmp_pdu_parse_fuzzer']
/src/net-snmp/snmplib/transports/snmpIPXDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPIPv6Domain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/agent_read_config.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp.c	['snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/container_null.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/container_binary_array.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/agentx_config.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/mibgroup/smux/smux.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmpusm.c	['snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/snmp_secmod.c	['snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_api_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpTLSBaseDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/snmp_enum.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_config_fuzzer.c	['snmp_config_fuzzer']	['snmp_config_fuzzer']
/src/net-snmp/agent/helpers/bulk_to_next.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/mibgroup/mibII/vacm_conf.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/file_utils.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	[]
/src/net-snmp/snmplib/snmp_auth.c	['snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_fuzzer']
/src/net-snmp/snmplib/lcd_time.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPsharedDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_parse_fuzzer.c	['snmp_parse_fuzzer']	['snmp_parse_fuzzer']
/src/net-snmp/agent/helpers/all_helpers.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_version.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpCallbackDomain.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/agentx_parse_fuzzer.c	['agentx_parse_fuzzer']	['agentx_parse_fuzzer']
/src/net-snmp/agent/helpers/table.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/agent/agent_handler.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_parse_args.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/keytools.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/transports/snmpAliasDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_print_var_fuzzer.c	['snmp_print_var_fuzzer']	['snmp_print_var_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_api_fuzzer.c	['snmp_api_fuzzer']	['snmp_api_fuzzer']
/src/net-snmp/agent/helpers/table_data.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/testing/fuzzing/snmp_agent_e2e_fuzzer.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_transport.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_config_mem_fuzzer.c	['snmp_config_mem_fuzzer']	['snmp_config_mem_fuzzer']
/src/net-snmp/agent/helpers/old_api.c	[]	[]
/src/net-snmp/snmplib/transports/snmpTLSTCPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/snmp_agent.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/scapi.c	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_transport_fuzzer.c	['snmp_transport_fuzzer']	['snmp_transport_fuzzer']
/src/net-snmp/snmplib/transports/snmpDTLSUDPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_args_fuzzer']

Directories in report

Directory
/src/net-snmp/snmplib/transports/
/src/net-snmp/snmplib/../include/net-snmp/library/
/src/net-snmp/agent/mibgroup/mibII/
/src/net-snmp/testing/fuzzing/
/src/net-snmp/agent/mibgroup/smux/
/src/net-snmp/snmplib/
/src/net-snmp/agent/
/usr/include/openssl/
/src/net-snmp/agent/mibgroup/utilities/
/src/net-snmp/agent/mibgroup/agentx/
/src/net-snmp/agent/mibgroup/snmpv3/
/src/net-snmp/agent/helpers/