High level conclusions

Fuzzers reach 64.40% of cyclomatic complexity.

Fuzzers reach 58.64% of all functions.

Fuzzer snmp_parse_trap_fuzzer is blocked:

The runtime code coverage of snmp_parse_trap_fuzzer covers 7.446% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer read_objid_fuzzer is blocked:

The runtime code coverage of read_objid_fuzzer covers 22.60% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer agentx_master_fuzzer is blocked:

The runtime code coverage of agentx_master_fuzzer covers 27.28% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_scoped_pdu_parse_fuzzer is blocked:

The runtime code coverage of snmp_scoped_pdu_parse_fuzzer covers 27.77% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_parse_fuzzer is blocked:

The runtime code coverage of snmp_parse_fuzzer covers 21.80% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_transport_fuzzer is blocked:

The runtime code coverage of snmp_transport_fuzzer covers 22.90% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_parse_oid_fuzzer is blocked:

The runtime code coverage of snmp_parse_oid_fuzzer covers 25.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer snmp_config_mem_fuzzer is blocked:

The runtime code coverage of snmp_config_mem_fuzzer covers 29.87% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1380 / 2353

Cyclomatic complexity statically reachable by fuzzers

13737 / 21329

Runtime code coverage of functions

995 / 2353

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: snmp_config_mem_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	934	85.6%
gold	[1:9]	69	6.32%
yellow	[10:29]	7	0.64%
greenyellow	[30:49]	3	0.27%
lawngreen	50+	78	7.14%
All colors	1091	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
591	403	strlcpy	call site: 00403	parse_compliance
122	198	find_tree_node	call site: 00198	parse_imports
67	129	print_error	call site: 00129	do_linkup
38	1016	snmp_set_detail	call site: 01016	parse_octet_hint
30	98	init_tree_roots	call site: 00098	read_from_file
19	383	print_module_not_found	call site: 00383	read_module_replacements
18	357	netsnmp_ds_set_string	call site: 00357	netsnmp_set_mib_directory
13	1002	_add_strings_to_oid	call site: 01002	find_tree_node
6	48	read_config_read_octet_string_const	call site: 00048	debugmsgtoken
5	5	copy_nword_const	call site: 00005	debugmsg
5	16	log_handler_stdouterr	call site: 00016	snprintf_stamp
5	347	netsnmp_set_mib_directory	call site: 00347	debugmsgtoken

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

115

Reachable functions

164

Percentage of reachable functions covered

29.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_config_mem_fuzzer.c	1
snmplib/read_config.c	11
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/default_store.c	4
snmplib/mib.c	15
snmplib/parse.c	77
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1
snmplib/int64.c	5

Fuzzer: snmp_pdu_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	433	61.7%
gold	[1:9]	4	0.57%
yellow	[10:29]	22	3.13%
greenyellow	[30:49]	15	2.13%
lawngreen	50+	227	32.3%
All colors	701	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
185	92	asn_parse_objid	call site: 00092	sprint_realloc_objid
158	278	snmp_log	call site: 00278	netsnmp_sprint_realloc_objid_tree
22	61	asn_parse_objid	call site: 00061	debugmsg
7	455	asn_parse_string	call site: 00455	debugmsg
5	24	snmp_pdu_parse	call site: 00024	debugmsg
5	35	log_handler_stdouterr	call site: 00035	snprintf_stamp
3	570	snmp_pdu_parse	call site: 00570	_asn_size_err
3	591	asn_parse_unsigned_int64	call site: 00591	debugmsg
3	595	snmp_pdu_parse	call site: 00595	_asn_size_err
3	613	snmp_pdu_parse	call site: 00613	_asn_size_err
3	633	snmp_pdu_parse	call site: 00633	_asn_size_err
3	655	asn_parse_signed_int64	call site: 00655	debugmsg

Runtime coverage analysis

Covered functions

41

Functions that are reachable but not covered

75

Reachable functions

115

Percentage of reachable functions covered

34.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_pdu_parse_fuzzer.c	1
snmplib/snmp_api.c	10
snmplib/asn1.c	18
snmplib/strlcpy.c	1
snmplib/snmp_debug.c	8
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/mib.c	30
snmplib/tools.c	3
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp.c	1
snmplib/snmp_client.c	1
snmplib/snmp_secmod.c	1

Fuzzer: snmp_parse_oid_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	937	88.0%
gold	[1:9]	64	6.01%
yellow	[10:29]	2	0.18%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	59	5.54%
All colors	1064	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
591	374	strlcpy	call site: 00374	parse_compliance
122	169	find_tree_node	call site: 00169	parse_imports
67	100	print_error	call site: 00100	do_linkup
38	987	snmp_set_detail	call site: 00987	parse_octet_hint
19	80	snmp_log	call site: 00080	parse
19	354	print_module_not_found	call site: 00354	read_module_replacements
18	328	netsnmp_ds_set_string	call site: 00328	netsnmp_set_mib_directory
13	973	_add_strings_to_oid	call site: 00973	find_tree_node
11	68	init_tree_roots	call site: 00068	read_from_file
8	4	snmp_parse_oid	call site: 00004	debugmsgtoken
5	18	log_handler_stdouterr	call site: 00018	snprintf_stamp
5	318	netsnmp_set_mib_directory	call site: 00318	debugmsgtoken

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

117

Reachable functions

156

Percentage of reachable functions covered

25.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_oid_fuzzer.c	1
snmplib/mib.c	19
snmplib/default_store.c	4
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/parse.c	80
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1

Fuzzer: snmp_transport_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1230	78.1%
gold	[1:9]	52	3.30%
yellow	[10:29]	28	1.78%
greenyellow	[30:49]	13	0.82%
lawngreen	50+	250	15.8%
All colors	1573	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
666	205	netsnmp_tlsbase_ctor	call site: 00205	netsnmp_certs_load
361	958	netsnmp_tdomain_dump	call site: 00958	sprint_realloc_objid
22	925	netsnmp_alias_ctor	call site: 00925	copy_nword
19	76	snmp_log	call site: 00076	copy_nword
18	126	init_snmp_transport	call site: 00126	netsnmp_transport_filter_add
15	56	netsnmp_ds_register_config	call site: 00056	netsnmp_ds_parse_boolean
11	1337	netsnmp_ipv6_fmtaddr	call site: 01337	netsnmp_gethostbyaddr
11	1399	netsnmp_getaddrinfo	call site: 01399	debugmsgtoken
9	102	skip_white_const	call site: 00102	netsnmp_ds_handle_config
8	116	init_snmp_transport	call site: 00116	netsnmp_ds_set_int
6	168	netsnmp_tlsbase_ctor	call site: 00168	copy_nword
5	4	netsnmp_ds_set_string	call site: 00004	debugmsg

Runtime coverage analysis

Covered functions

72

Functions that are reachable but not covered

239

Reachable functions

310

Percentage of reachable functions covered

22.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_transport_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	4
snmplib/default_store.c	9
snmplib/snmp_debug.c	5
snmplib/snmp_logging.c	6
snmplib/snmp_transport.c	11
snmplib/read_config.c	15
snmplib/strlcpy.c	1
snmplib/container.c	9
snmplib/transports/snmpTLSBaseDomain.c	5
snmplib/snmp_openssl.c	9
snmplib/callback.c	5
snmplib/cert_util.c	40
snmplib/tools.c	6
snmplib/system.c	4
snmplib/snmp_enum.c	8
snmplib/dir_utils.c	3
snmplib/file_utils.c	5
snmplib/data_list.c	4
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/snmp_api.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	3
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	6
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	2
snmplib/mib.c	30
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/transports/snmpIPv6BaseDomain.c	7
snmplib/transports/snmpIPBaseDomain.c	2

Fuzzer: snmp_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1659	79.6%
gold	[1:9]	14	0.67%
yellow	[10:29]	20	0.96%
greenyellow	[30:49]	7	0.33%
lawngreen	50+	383	18.3%
All colors	2083	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1130	951	_snmp_parse	call site: 00951	snmp_sess_send
337	301	asn_parse_objid	call site: 00301	sprint_realloc_objid
54	223	snmpv3_parse	call site: 00223	snmp_pdu_parse
27	852	snmp_pdu_parse	call site: 00852	snmp_pdu_parse
22	81	asn_parse_int	call site: 00081	debugmsg
12	187	asn_parse_string	call site: 00187	debugmsg
11	891	snmp_get_next_transid	call site: 00891	snmp_parse_version
5	4	snmpv3_parse	call site: 00004	debugmsg
5	15	log_handler_stdouterr	call site: 00015	snprintf_stamp
5	914	_snmp_parse	call site: 00914	debugmsgtoken
3	729	snmp_pdu_parse	call site: 00729	_asn_size_err
3	750	asn_parse_unsigned_int64	call site: 00750	debugmsg

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

165

Reachable functions

211

Percentage of reachable functions covered

21.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_fuzzer.c	1
snmplib/snmp_api.c	39
snmplib/snmp_debug.c	10
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/asn1.c	50
snmplib/strlcpy.c	1
snmplib/mib.c	30
snmplib/tools.c	5
snmplib/snmp_secmod.c	1
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp.c	4
snmplib/snmp_client.c	10
snmplib/snmp_auth.c	1
snmplib/callback.c	4
snmplib/snmpv3.c	2
snmplib/snmp_enum.c	4
snmplib/snmp_transport.c	2

Fuzzer: snmp_e2e_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4582	76.6%
gold	[1:9]	786	13.1%
yellow	[10:29]	103	1.72%
greenyellow	[30:49]	30	0.50%
lawngreen	50+	479	8.01%
All colors	5980	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1247	4629	_snmp_parse	call site: 04629	snmp_sess_send
593	2013	print_module_not_found	call site: 02013	read_module_replacements
159	1796	read_module_internal	call site: 01796	read_from_file
132	3003	snmp_set_detail	call site: 03003	usm_set_user_password
102	422	_get_cert_container	call site: 00422	netsnmp_directory_container_read_some
100	3769	netsnmp_parse_args	call site: 03769	netsnmp_container_init_list
93	1059	sprint_realloc_hexstring	call site: 01059	sprint_realloc_bitstring
84	1589	init_snmp_logging	call site: 01589	snmp_log_options
83	1236	netsnmp_sprint_realloc_objid_tree	call site: 01236	sprint_realloc_counter64
79	525	se_find_slist_ptr	call site: 00525	_add_certfile
66	669	_netsnmp_release_trustcerts	call site: 00669	_find_partner
65	1158	printI64	call site: 01158	netsnmp_sprint_realloc_objid_tree

Runtime coverage analysis

Covered functions

322

Functions that are reachable but not covered

505

Reachable functions

807

Percentage of reachable functions covered

37.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_e2e_fuzzer.c	3
snmplib/snmp_parse_args.c	3
snmplib/snmp_logging.c	26
snmplib/default_store.c	11
snmplib/snmp_api.c	84
snmplib/parse.c	86
snmplib/snmp_debug.c	18
snmplib/mib.c	42
snmplib/snmp_transport.c	21
snmplib/transports/snmpTLSBaseDomain.c	5
snmplib/snmp_openssl.c	9
snmplib/read_config.c	45
snmplib/strlcpy.c	1
snmplib/callback.c	7
snmplib/cert_util.c	44
snmplib/tools.c	12
snmplib/system.c	3
snmplib/snmp_enum.c	13
snmplib/dir_utils.c	3
snmplib/container.c	19
snmplib/file_utils.c	5
snmplib/data_list.c	4
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	1
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	1
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp_service.c	10
snmplib/snmp_version.c	1
snmplib/container_binary_array.c	22
snmplib/container_list_ssll.c	1
snmplib/container_null.c	2
snmplib/strlcat.c	1
snmplib/snmpv3.c	24
snmplib/lcd_time.c	4
snmplib/scapi.c	13
snmplib/snmp_secmod.c	4
snmplib/snmpusm.c	26
snmplib/keytools.c	5
snmplib/snmptsm.c	1
snmplib/snmpksm.c	2
snmplib/snmp_alarm.c	11
snmplib/vacm.c	1
snmplib/large_fd_set.c	8
snmplib/asn1.c	51
snmplib/snmp.c	4
snmplib/snmp_auth.c	1
snmplib/snmp_client.c	10

Fuzzer: snmp_parse_args_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2269	57.1%
gold	[1:9]	719	18.1%
yellow	[10:29]	119	2.99%
greenyellow	[30:49]	39	0.98%
lawngreen	50+	821	20.6%
All colors	3967	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
360	966	netsnmp_tdomain_dump	call site: 00966	sprint_realloc_objid
280	2235	parse_objectid	call site: 02235	parse_compliance
138	738	netsnmp_certs_load	call site: 00738	netsnmp_cert_load_x509
102	423	_get_cert_container	call site: 00423	netsnmp_directory_container_read_some
87	1838	get_tc_index	call site: 01838	do_subtree
82	2126	parse_ranges	call site: 02126	merge_parse_objectid
79	526	se_find_slist_ptr	call site: 00526	_add_certfile
66	670	_netsnmp_release_trustcerts	call site: 00670	_find_partner
65	3450	read_config	call site: 03450	read_config
53	606	snmp_realloc	call site: 00606	_add_cert
49	341	CONTAINER_CLEAR	call site: 00341	netsnmp_directory_container_read_some
46	3908	LLVMFuzzerTestOneInput	call site: 03908	snmp_sess_close

Runtime coverage analysis

Covered functions

350

Functions that are reachable but not covered

326

Reachable functions

657

Percentage of reachable functions covered

50.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_args_fuzzer.c	2
testing/fuzzing/ada_fuzz_header.h	5
snmplib/snmp_parse_args.c	3
snmplib/snmp_logging.c	26
snmplib/default_store.c	11
snmplib/snmp_api.c	26
snmplib/parse.c	86
snmplib/snmp_debug.c	13
snmplib/mib.c	42
snmplib/snmp_transport.c	15
snmplib/transports/snmpTLSBaseDomain.c	5
snmplib/snmp_openssl.c	9
snmplib/read_config.c	45
snmplib/strlcpy.c	1
snmplib/callback.c	7
snmplib/cert_util.c	44
snmplib/tools.c	10
snmplib/system.c	3
snmplib/snmp_enum.c	13
snmplib/dir_utils.c	3
snmplib/container.c	18
snmplib/file_utils.c	5
snmplib/data_list.c	4
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	1
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	1
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp_service.c	10
snmplib/snmp_version.c	1
snmplib/container_binary_array.c	22
snmplib/container_list_ssll.c	1
snmplib/container_null.c	2
snmplib/strlcat.c	1
snmplib/snmpv3.c	23
snmplib/lcd_time.c	4
snmplib/scapi.c	13
snmplib/snmp_secmod.c	4
snmplib/snmpusm.c	20
snmplib/keytools.c	5
snmplib/snmptsm.c	1
snmplib/snmpksm.c	2
snmplib/snmp_alarm.c	11
snmplib/vacm.c	1

Fuzzer: snmp_scoped_pdu_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	94	70.6%
gold	[1:9]	13	9.77%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.50%
lawngreen	50+	24	18.0%
All colors	133	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	57	asn_parse_string	call site: 00057	debugmsg_hex
22	27	snmpv3_scopedPDU_parse	call site: 00027	debugmsg
13	110	snmpv3_scopedPDU_parse	call site: 00110	asn_parse_string
3	125	snmp_free_pdu	call site: 00125	snmp_log
2	53	snmpv3_scopedPDU_parse	call site: 00053	snmp_log
2	130	snmp_free_pdu	call site: 00130	snmp_free_var
1	4	asn_parse_sequence	call site: 00004	snmp_set_detail
1	13	asn_parse_nlength	call site: 00013	snmp_set_detail

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

39

Reachable functions

54

Percentage of reachable functions covered

27.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_scoped_pdu_parse_fuzzer.c	1
snmplib/snmp_api.c	7
snmplib/asn1.c	8
snmplib/strlcpy.c	1
snmplib/snmp_debug.c	7
snmplib/snmp_logging.c	6
snmplib/default_store.c	2
snmplib/mib.c	4
snmplib/tools.c	2
snmplib/snmp_secmod.c	1

Fuzzer: snmp_sec_models_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1561	72.6%
gold	[1:9]	27	1.25%
yellow	[10:29]	76	3.53%
greenyellow	[30:49]	16	0.74%
lawngreen	50+	468	21.7%
All colors	2148	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
973	1090	se_find_slist_ptr	call site: 01090	snmp_build
328	221	name_hash	call site: 00221	_get_realloc_symbol
46	1043	snmp_sess_async_send	call site: 01043	_sess_async_send
38	114	asn_parse_int	call site: 00114	snmp_comstr_parse
22	87	asn_parse_int	call site: 00087	debugmsg
22	165	asn_parse_string	call site: 00165	snmp_pdu_parse
15	57	asn_parse_sequence	call site: 00057	asn_parse_int
13	1025	snmp_varlist_add_variable	call site: 01025	snmp_log
8	212	asn_parse_objid	call site: 00212	sprint_realloc_objid
5	13	log_handler_stdouterr	call site: 00013	snprintf_stamp
5	2075	_snmp_parse	call site: 02075	snmp_set_detail
5	2136	netsnmp_cleanup_session	call site: 02136	debugmsgtoken

Runtime coverage analysis

Covered functions

297

Functions that are reachable but not covered

145

Reachable functions

225

Percentage of reachable functions covered

35.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_sec_models_fuzzer.c	1
snmplib/tools.c	5
snmplib/snmp_api.c	42
snmplib/snmp_secmod.c	1
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/asn1.c	50
snmplib/strlcpy.c	1
snmplib/snmp_debug.c	10
snmplib/mib.c	30
snmplib/snmp_auth.c	1
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp.c	4
snmplib/snmp_client.c	10
snmplib/callback.c	4
snmplib/snmpv3.c	2
snmplib/snmp_enum.c	4
snmplib/snmp_transport.c	2
snmplib/vacm.c	6
snmplib/snmpusm.c	1
snmplib/container.c	2

Fuzzer: snmp_api_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2023	55.4%
gold	[1:9]	125	3.42%
yellow	[10:29]	90	2.46%
greenyellow	[30:49]	118	3.23%
lawngreen	50+	1293	35.4%
All colors	3649	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
610	1185	print_module_not_found	call site: 01185	read_module_replacements
328	310	find_tree_node	call site: 00310	_get_realloc_symbol
191	3278	snmp_pdu_realloc_rbuild	call site: 03278	snmpv3_packet_build
178	944	print_error	call site: 00944	parse_imports
80	2731	snmpv3_parse	call site: 02731	snmp_pdu_parse
70	3552	_snmp_build	call site: 03552	snmp_build
67	2843	_snmp_parse	call site: 02843	snmp_sess_send
51	1803	_add_strings_to_oid	call site: 01803	parse_octet_hint
45	2917	_snmp_build	call site: 02917	snmpv3_packet_realloc_rbuild
45	3232	snmp_pdu_realloc_rbuild	call site: 03232	asn_realloc_rbuild_objid
30	907	init_tree_roots	call site: 00907	read_from_file
25	2815	_snmp_parse	call site: 02815	snmp_call_callbacks

Runtime coverage analysis

Covered functions

163

Functions that are reachable but not covered

206

Reachable functions

365

Percentage of reachable functions covered

43.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_api_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	7
agent/mibgroup/agentx/protocol.c	11
snmplib/snmp_debug.c	10
snmplib/snmp_logging.c	7
snmplib/default_store.c	5
snmplib/mib.c	50
snmplib/tools.c	9
snmplib/snmp_client.c	11
snmplib/parse.c	81
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	9
snmplib/snmp_api.c	45
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/asn1.c	50
snmplib/snmp.c	4
snmplib/snmp_secmod.c	1
snmplib/snmp_auth.c	1
snmplib/callback.c	4
snmplib/snmpv3.c	3
snmplib/snmp_enum.c	4
snmplib/snmp_transport.c	2

Fuzzer: snmp_mib_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	10.8%
gold	[1:9]	48	4.90%
yellow	[10:29]	24	2.45%
greenyellow	[30:49]	10	1.02%
lawngreen	50+	790	80.7%
All colors	978	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	345	netsnmp_ds_set_string	call site: 00345	netsnmp_set_mib_directory
10	96	new_module	call site: 00096	debugmsgtoken
7	165	do_linkup	call site: 00165	dump_module_list
6	52	print_error	call site: 00052	debugmsgtoken
5	18	log_handler_stdouterr	call site: 00018	snprintf_stamp
5	29	snmp_vlog	call site: 00029	snmp_log
5	36	read_mib	call site: 00036	debugmsg
5	189	module_name	call site: 00189	debugmsgtoken
5	335	netsnmp_set_mib_directory	call site: 00335	debugmsgtoken
4	7	read_mib	call site: 00007	snmp_log_perror
3	910	parse_asntype	call site: 00910	get_token
2	148	read_from_file	call site: 00148	snmp_log_perror

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

41

Reachable functions

138

Percentage of reachable functions covered

70.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_mib_fuzzer.c	1
snmplib/parse.c	80
snmplib/snmp_logging.c	7
snmplib/default_store.c	4
snmplib/snmp_debug.c	4
snmplib/mib.c	4
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1

Fuzzer: agentx_master_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5858	80.8%
gold	[1:9]	267	3.68%
yellow	[10:29]	113	1.55%
greenyellow	[30:49]	19	0.26%
lawngreen	50+	987	13.6%
All colors	7244	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
918	2886	_build_initial_pdu_packet	call site: 02886	snmp_build
793	4387	allocate_idx_list	call site: 04387	register_index
616	5662	print_module_not_found	call site: 05662	read_module_replacements
360	959	netsnmp_tdomain_dump	call site: 00959	sprint_realloc_objid
204	7023	agentx_notify	call site: 07023	send_trap_vars
180	6513	read_config_files_of_type	call site: 06513	read_config_files_in_path
179	5425	print_error	call site: 05425	parse_imports
170	5202	netsnmp_get_next_alarm_time	call site: 05202	agentx_synch_input
159	2623	snmp_clone_var	call site: 02623	netsnmp_wrap_up_request
157	6831	netsnmp_callback_open	call site: 06831	remove_index
138	731	netsnmp_certs_load	call site: 00731	netsnmp_cert_load_x509
103	6701	snmp_error	call site: 06701	agentx_open_session

Runtime coverage analysis

Covered functions

420

Functions that are reachable but not covered

621

Reachable functions

854

Percentage of reachable functions covered

27.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/agentx_master_fuzzer.c	1
snmplib/snmp_api.c	100
snmplib/parse.c	81
snmplib/snmp_debug.c	13
snmplib/snmp_logging.c	7
snmplib/default_store.c	9
snmplib/mib.c	52
snmplib/snmp_transport.c	20
snmplib/transports/snmpTLSBaseDomain.c	5
snmplib/snmp_openssl.c	9
snmplib/read_config.c	21
snmplib/strlcpy.c	1
snmplib/callback.c	9
snmplib/cert_util.c	40
snmplib/tools.c	15
snmplib/system.c	4
snmplib/snmp_enum.c	8
snmplib/dir_utils.c	3
snmplib/container.c	13
snmplib/file_utils.c	5
snmplib/data_list.c	5
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	1
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	1
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	9
snmplib/snmp_service.c	7
snmplib/snmp_secmod.c	1
snmplib/snmpusm.c	2
agent/mibgroup/agentx/protocol.c	23
snmplib/snmp_client.c	17
agent/mibgroup/agentx/master_admin.c	13
agent/snmp_agent.c	39
agent/agent_registry.c	36
agent/agent_handler.c	16
snmplib/snmpv3.c	2
snmplib/asn1.c	51
snmplib/snmp.c	4
agent/agent_index.c	4
agent/agent_sysORTable.c	5
agent/mibgroup/agentx/master.c	4
agent/helpers/null.c	2
agent/helpers/bulk_to_next.c	3
agent/mibgroup/agentx/client.c	11
snmplib/large_fd_set.c	9
snmplib/snmp_auth.c	1
snmplib/snmp_alarm.c	12
agent/mibgroup/agentx/subagent.c	18
snmplib/strlcat.c	1
agent/agent_trap.c	14
snmplib/snmp_version.c	1
snmplib/transports/snmpCallbackDomain.c	8

Fuzzer: agentx_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	580	39.2%
gold	[1:9]	7	0.47%
yellow	[10:29]	61	4.12%
greenyellow	[30:49]	108	7.31%
lawngreen	50+	721	48.8%
All colors	1477	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
338	299	agentx_parse_oid	call site: 00299	sprint_realloc_objid
22	6	agentx_parse_header	call site: 00006	debugmsg
17	49	snmp_realloc	call site: 00049	debugmsg
10	195	agentx_parse_string	call site: 00195	debugmsg
8	661	snmp_set_var_value	call site: 00661	snmp_log
8	1263	agentx_realloc_build_varbind	call site: 01263	debug_indent_add
7	1385	agentx_realloc_build_varbind	call site: 01385	debugmsgtoken
6	654	snmp_varlist_add_variable	call site: 00654	snmp_log
6	1312	agentx_realloc_build_float	call site: 01312	debug_indent_add
6	1336	agentx_realloc_build_double	call site: 01336	debug_indent_add
6	1361	agentx_realloc_build_varbind	call site: 01361	debug_indent_add
6	1377	agentx_realloc_build_varbind	call site: 01377	debug_indent_add

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

88

Reachable functions

129

Percentage of reachable functions covered

31.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/agentx_parse_fuzzer.c	1
agent/mibgroup/agentx/protocol.c	22
snmplib/snmp_debug.c	8
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/mib.c	30
snmplib/tools.c	2
snmplib/snmp_client.c	4
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp_api.c	11
snmplib/strlcpy.c	1
snmplib/snmp_secmod.c	1
snmplib/snmpusm.c	1
snmplib/container.c	2

Fuzzer: snmp_config_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	944	74.3%
gold	[1:9]	74	5.82%
yellow	[10:29]	3	0.23%
greenyellow	[30:49]	2	0.15%
lawngreen	50+	247	19.4%
All colors	1270	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
527	468	parse	call site: 00468	parse_compliance
167	215	parse	call site: 00215	parse_imports
32	434	netsnmp_read_module	call site: 00434	read_module_replacements
26	404	netsnmp_ds_set_string	call site: 00404	netsnmp_set_mib_directory
19	996	parse	call site: 00996	debugmsgtoken
19	1049	config_vlog	call site: 01049	copy_nword
17	45	register_mib_handlers	call site: 00045	debugmsgtoken
17	383	netsnmp_getenv	call site: 00383	netsnmp_set_mib_directory
16	64	register_mib_handlers	call site: 00064	debugmsgtoken
16	1030	netsnmp_ds_register_premib	call site: 01030	netsnmp_ds_parse_boolean
12	111	print_error	call site: 00111	debugmsgtoken
8	125	get_token	call site: 00125	netsnmp_ds_get_boolean

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

119

Reachable functions

176

Percentage of reachable functions covered

32.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_config_fuzzer.c	1
snmplib/mib.c	8
snmplib/read_config.c	21
snmplib/default_store.c	9
snmplib/strlcpy.c	1
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/parse.c	78
snmplib/tools.c	2
snmplib/strlcat.c	1

Fuzzer: snmp_agent_e2e_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8296	74.4%
gold	[1:9]	124	1.11%
yellow	[10:29]	125	1.12%
greenyellow	[30:49]	54	0.48%
lawngreen	50+	2540	22.8%
All colors	11139	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1106	7487	init_agent	call site: 07487	subagent_init
974	5077	_asn_size_err	call site: 05077	send_enterprise_trap_vars
439	6681	read_objid	call site: 06681	netsnmp_register_table_data_set
426	8949	snmp_pdu_parse	call site: 08949	agentx_synch_input
253	81	find_tree_node	call site: 00081	_get_realloc_symbol
232	1178	_get_cert_container	call site: 01178	_add_certfile
216	9380	snmp_unregister_callback	call site: 09380	subagent_shutdown
182	4375	read_configs	call site: 04375	init_snmp
134	1489	netsnmp_certs_load	call site: 01489	netsnmp_cert_load_x509
126	10580	init_vacm_conf	call site: 10580	vacm_in_view
109	4872	_copy_pdu_vars	call site: 04872	send_trap_to_sess
106	10766	init_master_agent	call site: 10766	real_init_master

Runtime coverage analysis

Covered functions

619

Functions that are reachable but not covered

898

Reachable functions

1475

Percentage of reachable functions covered

39.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_agent_e2e_fuzzer.c	3
testing/fuzzing/ada_fuzz_header.h	4
agent/snmp_vars.c	6
snmplib/snmp_logging.c	28
snmplib/default_store.c	12
agent/snmp_agent.c	60
snmplib/tools.c	17
snmplib/snmp_debug.c	21
agent/kernel.c	2
agent/agent_registry.c	42
snmplib/snmp_api.c	108
agent/helpers/null.c	3
agent/agent_handler.c	27
snmplib/mib.c	68
snmplib/parse.c	91
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	9
agent/helpers/bulk_to_next.c	4
snmplib/snmp_enum.c	15
snmplib/snmp_client.c	21
snmplib/callback.c	10
agent/agent_read_config.c	8
snmplib/read_config.c	54
snmplib/strlcpy.c	1
agent/agent_trap.c	27
snmplib/snmp_transport.c	31
snmplib/transports/snmpTLSBaseDomain.c	5
snmplib/snmp_openssl.c	10
snmplib/cert_util.c	74
snmplib/system.c	8
snmplib/dir_utils.c	3
snmplib/container.c	23
snmplib/file_utils.c	5
snmplib/data_list.c	8
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	6
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	10
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	7
snmplib/snmp_service.c	14
snmplib/strlcat.c	1
snmplib/snmp_secmod.c	7
snmplib/snmpusm.c	34
snmplib/snmp_parse_args.c	2
snmplib/snmp_version.c	1
snmplib/container_binary_array.c	22
snmplib/container_list_ssll.c	1
snmplib/container_null.c	2
snmplib/snmpv3.c	24
snmplib/lcd_time.c	5
snmplib/scapi.c	15
snmplib/keytools.c	5
snmplib/snmptsm.c	2
snmplib/snmpksm.c	3
snmplib/snmp_alarm.c	15
snmplib/vacm.c	22
snmplib/transports/snmpCallbackDomain.c	9
snmplib/asn1.c	51
snmplib/snmp.c	4
agent/helpers/all_helpers.c	1
agent/helpers/debug_handler.c	4
agent/helpers/serialize.c	3
agent/helpers/read_only.c	3
agent/helpers/table_dataset.c	24
agent/helpers/table_data.c	17
agent/helpers/table.c	13
snmplib/oid_stash.c	7
agent/helpers/row_merge.c	5
agent/helpers/stash_cache.c	10
agent/helpers/cache_handler.c	15
agent/helpers/stash_to_next.c	2
agent/agent_sysORTable.c	10
agent/mibgroup/agentx/agentx_config.c	8
agent/mibgroup/agentx/subagent.c	20
agent/mibgroup/agentx/protocol.c	23
agent/mibgroup/agentx/client.c	9
snmplib/large_fd_set.c	9
snmplib/snmp_auth.c	1
agent/mibgroup/smux/smux.c	5
agent/mibgroup/snmpv3/usmConf.c	1
agent/mibgroup/utilities/iquery.c	7
agent/mibgroup/mibII/vacm_conf.c	29
agent/mibgroup/agentx/master.c	4
agent/mibgroup/agentx/master_admin.c	1
agent/agent_index.c	1
snmplib/transports/snmpIPv4BaseDomain.c	3
snmplib/transports/snmpIPBaseDomain.c	2

Fuzzer: parse_octet_hint_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	75.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	7	21.8%
lawngreen	50+	1	3.12%
All colors	32	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	7	parse_hints_ctor	call site: 00007	parse_hints_parse

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

9

Reachable functions

13

Percentage of reachable functions covered

30.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/parse_octet_hint_fuzzer.c	1
snmplib/mib.c	6

Fuzzer: read_objid_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	926	89.7%
gold	[1:9]	64	6.20%
yellow	[10:29]	2	0.19%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	3.87%
All colors	1032	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
591	363	strlcpy	call site: 00363	parse_compliance
122	158	find_tree_node	call site: 00158	parse_imports
67	89	print_error	call site: 00089	do_linkup
38	976	snmp_set_detail	call site: 00976	parse_octet_hint
19	69	snmp_log	call site: 00069	parse
19	343	print_module_not_found	call site: 00343	read_module_replacements
18	317	netsnmp_ds_set_string	call site: 00317	netsnmp_set_mib_directory
13	962	_add_strings_to_oid	call site: 00962	find_tree_node
11	57	init_tree_roots	call site: 00057	read_from_file
5	17	which_module	call site: 00017	debugmsg
5	28	log_handler_stdouterr	call site: 00028	snprintf_stamp
5	307	netsnmp_set_mib_directory	call site: 00307	debugmsgtoken

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

113

Reachable functions

146

Percentage of reachable functions covered

22.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/read_objid_fuzzer.c	1
snmplib/mib.c	15
snmplib/parse.c	77
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/default_store.c	4
snmplib/tools.c	1
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1

Fuzzer: snmp_print_var_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1126	77.3%
gold	[1:9]	104	7.14%
yellow	[10:29]	34	2.33%
greenyellow	[30:49]	28	1.92%
lawngreen	50+	163	11.2%
All colors	1455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
591	387	strlcpy	call site: 00387	parse_compliance
115	189	module_name	call site: 00189	parse_imports
67	113	print_error	call site: 00113	do_linkup
48	1361	sprint_realloc_integer	call site: 01361	netsnmp_sprint_realloc_objid_tree
38	1000	snmp_set_detail	call site: 01000	parse_octet_hint
19	93	snmp_log	call site: 00093	parse
19	367	print_module_not_found	call site: 00367	read_module_replacements
18	341	netsnmp_ds_set_string	call site: 00341	netsnmp_set_mib_directory
15	1100	sprint_realloc_by_type	call site: 01100	sprint_realloc_asciistring
11	81	init_tree_roots	call site: 00081	read_from_file
10	1082	_get_realloc_symbol	call site: 01082	_get_realloc_symbol_octet_string
9	990	_add_strings_to_oid	call site: 00990	find_tree_node

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

122

Reachable functions

198

Percentage of reachable functions covered

38.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_print_var_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	5
snmplib/default_store.c	5
snmplib/snmp_debug.c	4
snmplib/snmp_logging.c	7
snmplib/mib.c	49
snmplib/parse.c	78
snmplib/tools.c	3
snmplib/strlcpy.c	1
snmplib/strlcat.c	1
snmplib/snmp_api.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5

Fuzzer: snmp_parse_trap_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1484	97.1%
gold	[1:9]	11	0.71%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	33	2.15%
All colors	1528	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1090	436	netsnmp_get_traphandler	call site: 00436	snmp_send
362	42	snmp_input	call site: 00042	sprint_realloc_objid
13	420	netsnmp_get_traphandler	call site: 00420	debugmsgtoken
5	9	snmp_input	call site: 00009	debugmsg
5	20	log_handler_stdouterr	call site: 00020	snprintf_stamp
3	410	snmp_input	call site: 00410	debugmsgtoken
2	32	snmp_input	call site: 00032	snmp_oid_compare
1	15	snmp_vlog	call site: 00015	snmp_log_string
1	27	log_handler_stdouterr	call site: 00027	printf
1	29	log_handler_stdouterr	call site: 00029	log_handler_stdouterr
1	36	snmp_log	call site: 00036	snmp_log

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

174

Reachable functions

188

Percentage of reachable functions covered

7.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_trap_fuzzer.c	1
testing/fuzzing/ada_fuzz_header.h	4
apps/snmptrapd_handlers.c	2
snmplib/snmp_debug.c	10
snmplib/snmp_logging.c	6
snmplib/default_store.c	3
snmplib/snmp_api.c	34
snmplib/mib.c	30
snmplib/parse.c	4
snmplib/../include/net-snmp/library/tools.h	1
snmplib/tools.c	4
snmplib/int64.c	5
apps/snmptrapd_auth.c	1
snmplib/snmp_client.c	9
snmplib/snmp_secmod.c	1
snmplib/snmpv3.c	1
snmplib/snmp_enum.c	4
snmplib/asn1.c	34
snmplib/snmp.c	3
snmplib/strlcpy.c	1
snmplib/snmp_transport.c	2

Fuzzer: snmp_parse_trap2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4308	72.6%
gold	[1:9]	112	1.88%
yellow	[10:29]	323	5.45%
greenyellow	[30:49]	36	0.60%
lawngreen	50+	1147	19.3%
All colors	5926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
593	1933	print_module_not_found	call site: 01933	read_module_replacements
384	5185	snmpv3_packet_realloc_rbuild	call site: 05185	snmpv3_packet_build
360	963	netsnmp_tdomain_dump	call site: 00963	sprint_realloc_objid
199	4256	asn_parse_unsigned_int	call site: 04256	snmp_parse_var_op
138	735	netsnmp_certs_load	call site: 00735	netsnmp_cert_load_x509
133	523	se_find_slist_ptr	call site: 00523	_add_certfile
115	2923	snmp_set_detail	call site: 02923	usm_extend_user_kul
102	420	_get_cert_container	call site: 00420	netsnmp_directory_container_read_some
96	5571	snmpv3_build	call site: 05571	snmp_build
94	3343	read_premib_configs	call site: 03343	read_configs_optional
88	5721	_sess_process_packet_parse_pdu	call site: 05721	_sess_process_packet
84	1509	init_snmp_logging	call site: 01509	snmp_log_options

Runtime coverage analysis

Covered functions

437

Functions that are reachable but not covered

471

Reachable functions

831

Percentage of reachable functions covered

43.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
testing/fuzzing/snmp_parse_trap2_fuzzer.c	2
snmplib/default_store.c	11
snmplib/snmp_debug.c	19
snmplib/snmp_logging.c	27
snmplib/snmp_api.c	90
snmplib/parse.c	87
snmplib/mib.c	41
snmplib/snmp_transport.c	27
snmplib/transports/snmpTLSBaseDomain.c	5
snmplib/snmp_openssl.c	9
snmplib/read_config.c	45
snmplib/strlcpy.c	1
snmplib/callback.c	8
snmplib/cert_util.c	44
snmplib/tools.c	10
snmplib/system.c	3
snmplib/snmp_enum.c	15
snmplib/dir_utils.c	3
snmplib/container.c	21
snmplib/file_utils.c	5
snmplib/data_list.c	5
snmplib/transports/snmpTLSTCPDomain.c	1
snmplib/transports/snmpDTLSUDPDomain.c	1
snmplib/transports/snmpUDPsharedDomain.c	1
snmplib/transports/snmpSTDDomain.c	1
snmplib/transports/snmpIPXDomain.c	1
snmplib/transports/snmpAAL5PVCDomain.c	1
snmplib/transports/snmpUDPIPv6Domain.c	1
snmplib/transports/snmpTCPIPv6Domain.c	1
snmplib/transports/snmpUDPDomain.c	1
snmplib/transports/snmpTCPDomain.c	1
snmplib/transports/snmpAliasDomain.c	3
snmplib/transports/snmpUnixDomain.c	1
snmplib/../include/net-snmp/library/tools.h	1
snmplib/int64.c	5
snmplib/snmp_service.c	14
snmplib/container_binary_array.c	22
snmplib/container_list_ssll.c	1
snmplib/container_null.c	2
snmplib/strlcat.c	1
snmplib/snmpv3.c	22
snmplib/lcd_time.c	5
snmplib/scapi.c	13
snmplib/snmp_secmod.c	7
snmplib/snmpusm.c	21
snmplib/keytools.c	5
snmplib/snmptsm.c	2
snmplib/snmpksm.c	3
snmplib/snmp_alarm.c	12
snmplib/vacm.c	1
snmplib/large_fd_set.c	10
snmplib/asn1.c	51
snmplib/snmp.c	4
snmplib/snmp_auth.c	1
snmplib/snmp_client.c	11

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
netsnmp_dtlsudp_close	/src/net-snmp/snmplib/transports/snmpDTLSUDPDomain.c	1	['N/A']	18	0	506	100	28	258	0	1393	782
snmptrapd_parse_traphandle	/src/net-snmp/apps/snmptrapd_handlers.c	2	['N/A', 'N/A']	13	0	293	56	18	251	1	2744	485
smux_process	/src/net-snmp/agent/mibgroup/smux/smux.c	1	['int']	25	0	535	103	33	317	0	3453	383
usm_secmod_process_in_msg	/src/net-snmp/snmplib/snmpusm.c	1	['N/A']	16	0	80	6	3	159	0	1378	374
netsnmp_udpshared_create_tspec	/src/net-snmp/snmplib/transports/snmpUDPsharedDomain.c	1	['N/A']	17	0	82	16	6	130	0	752	368
usm_secmod_rgenerate_out_msg	/src/net-snmp/snmplib/snmpusm.c	1	['N/A']	15	0	82	6	3	145	0	1227	196
netsnmp_tlstcp_open	/src/net-snmp/snmplib/transports/snmpTLSTCPDomain.c	1	['N/A']	18	0	83	21	6	259	0	1391	194

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1567 / 2353

Cyclomatic complexity statically reachable by fuzzers

16311 / 21329

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

testing/fuzzing/snmp_config_mem_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'find_tree_node', 'print_error', 'snmp_set_detail', 'init_tree_roots', 'print_module_not_found', 'netsnmp_ds_set_string', '_add_strings_to_oid', 'read_config_read_octet_string_const', 'copy_nword_const']

testing/fuzzing/snmp_pdu_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['asn_parse_objid', 'snmp_log', 'asn_parse_string', 'snmp_pdu_parse', 'log_handler_stdouterr', 'asn_parse_unsigned_int64']

testing/fuzzing/snmp_parse_oid_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'find_tree_node', 'print_error', 'snmp_set_detail', 'snmp_log', 'print_module_not_found', 'netsnmp_ds_set_string', '_add_strings_to_oid', 'init_tree_roots', 'snmp_parse_oid']

testing/fuzzing/snmp_transport_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['netsnmp_tlsbase_ctor', 'netsnmp_tdomain_dump', 'netsnmp_alias_ctor', 'snmp_log', 'init_snmp_transport', 'netsnmp_ds_register_config', 'netsnmp_ipv6_fmtaddr', 'netsnmp_getaddrinfo', 'skip_white_const']

testing/fuzzing/snmp_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_snmp_parse', 'asn_parse_objid', 'snmpv3_parse', 'snmp_pdu_parse', 'asn_parse_int', 'asn_parse_string', 'snmp_get_next_transid', 'log_handler_stdouterr']

testing/fuzzing/snmp_e2e_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_snmp_parse', 'print_module_not_found', 'read_module_internal', 'snmp_set_detail', '_get_cert_container', 'netsnmp_parse_args', 'sprint_realloc_hexstring', 'init_snmp_logging', 'netsnmp_sprint_realloc_objid_tree', 'se_find_slist_ptr']

testing/fuzzing/snmp_parse_args_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['netsnmp_tdomain_dump', 'parse_objectid', 'netsnmp_certs_load', '_get_cert_container', 'get_tc_index', 'parse_ranges', 'se_find_slist_ptr', '_netsnmp_release_trustcerts', 'read_config', 'snmp_realloc']

testing/fuzzing/snmp_scoped_pdu_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['asn_parse_string', 'snmpv3_scopedPDU_parse', 'snmp_free_pdu', 'asn_parse_sequence', 'asn_parse_nlength']

testing/fuzzing/snmp_sec_models_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['se_find_slist_ptr', 'name_hash', 'snmp_sess_async_send', 'asn_parse_int', 'asn_parse_string', 'asn_parse_sequence', 'snmp_varlist_add_variable', 'asn_parse_objid', 'log_handler_stdouterr']

testing/fuzzing/snmp_api_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['print_module_not_found', 'find_tree_node', 'snmp_pdu_realloc_rbuild', 'print_error', 'snmpv3_parse', '_snmp_build', '_snmp_parse', '_add_strings_to_oid']

testing/fuzzing/snmp_mib_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['netsnmp_ds_set_string', 'new_module', 'do_linkup', 'print_error', 'log_handler_stdouterr', 'snmp_vlog', 'read_mib', 'module_name', 'netsnmp_set_mib_directory']

testing/fuzzing/agentx_master_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_build_initial_pdu_packet', 'allocate_idx_list', 'print_module_not_found', 'netsnmp_tdomain_dump', 'agentx_notify', 'read_config_files_of_type', 'print_error', 'netsnmp_get_next_alarm_time', 'snmp_clone_var', 'netsnmp_callback_open']

testing/fuzzing/agentx_parse_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['agentx_parse_oid', 'agentx_parse_header', 'snmp_realloc', 'agentx_parse_string', 'snmp_set_var_value', 'agentx_realloc_build_varbind', 'snmp_varlist_add_variable', 'agentx_realloc_build_float', 'agentx_realloc_build_double']

testing/fuzzing/snmp_config_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse', 'netsnmp_read_module', 'netsnmp_ds_set_string', 'config_vlog', 'register_mib_handlers', 'netsnmp_getenv', 'netsnmp_ds_register_premib']

testing/fuzzing/snmp_agent_e2e_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['init_agent', '_asn_size_err', 'read_objid', 'snmp_pdu_parse', 'find_tree_node', '_get_cert_container', 'snmp_unregister_callback', 'read_configs', 'netsnmp_certs_load', 'init_vacm_conf']

testing/fuzzing/parse_octet_hint_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_hints_ctor']

testing/fuzzing/read_objid_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'find_tree_node', 'print_error', 'snmp_set_detail', 'snmp_log', 'print_module_not_found', 'netsnmp_ds_set_string', '_add_strings_to_oid', 'init_tree_roots', 'which_module']

testing/fuzzing/snmp_print_var_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['strlcpy', 'module_name', 'print_error', 'sprint_realloc_integer', 'snmp_set_detail', 'snmp_log', 'print_module_not_found', 'netsnmp_ds_set_string', 'sprint_realloc_by_type', 'init_tree_roots']

testing/fuzzing/snmp_parse_trap_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['netsnmp_get_traphandler', 'snmp_input', 'log_handler_stdouterr', 'snmp_vlog']

testing/fuzzing/snmp_parse_trap2_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['print_module_not_found', 'snmpv3_packet_realloc_rbuild', 'netsnmp_tdomain_dump', 'asn_parse_unsigned_int', 'netsnmp_certs_load', 'se_find_slist_ptr', 'snmp_set_detail', '_get_cert_container', 'snmpv3_build', 'read_premib_configs']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
_add_strings_to_oid	373	122	32.70%	['snmp_agent_e2e_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'read_objid_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_config_mem_fuzzer', 'snmp_print_var_fuzzer']
netsnmp_getaddrinfo	66	30	45.45%	['snmp_agent_e2e_fuzzer', 'snmp_transport_fuzzer', 'agentx_master_fuzzer', 'snmp_parse_trap2_fuzzer']
netsnmp_ipv6_fmtaddr	44	22	50.0%	['snmp_transport_fuzzer']
register_sec_mod	43	20	46.51%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer']
_certindexes_load	43	21	48.83%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer']
_add_certdir	63	14	22.22%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer']
netsnmp_large_fd_set_resize	41	21	51.21%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_e2e_fuzzer', 'agentx_master_fuzzer']
_get_realloc_symbol	357	48	13.44%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
_sess_copy	239	108	45.18%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_e2e_fuzzer', 'agentx_master_fuzzer']
__sess_read	212	65	30.66%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_e2e_fuzzer', 'agentx_master_fuzzer']
_sess_process_packet_parse_pdu	102	38	37.25%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_e2e_fuzzer', 'agentx_master_fuzzer']
_sess_process_packet_handle_pdu	99	21	21.21%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_e2e_fuzzer', 'agentx_master_fuzzer']
usm_free_user	51	24	47.05%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_args_fuzzer']
usm_create_user_from_session	211	10	4.739%	['snmp_e2e_fuzzer']
usm_session_init	85	33	38.82%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_e2e_fuzzer', 'agentx_master_fuzzer']
setup_engineID	147	57	38.77%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_args_fuzzer']
_ssll_insert	44	23	52.27%	['snmp_parse_args_fuzzer']
netsnmp_extend_kul	74	16	21.62%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer']
snmp_set_var_value	176	94	53.40%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_sec_models_fuzzer']
ksm_process_in_msg	381	168	44.09%	['snmp_sec_models_fuzzer']
ksm_decrement_ref_count	32	10	31.25%	['snmp_sec_models_fuzzer']
tsm_process_in_msg	108	20	18.51%	['snmp_sec_models_fuzzer']
usm_create_usmUser_from_string	291	131	45.01%	['snmp_agent_e2e_fuzzer', 'snmp_sec_models_fuzzer']
usm_process_in_msg	268	144	53.73%	['snmp_parse_trap2_fuzzer', 'snmp_sec_models_fuzzer']
usm_check_secLevel	37	20	54.05%	['snmp_parse_trap2_fuzzer', 'snmp_sec_models_fuzzer']
vacm_createAccessEntry	53	25	47.16%	['snmp_agent_e2e_fuzzer', 'snmp_sec_models_fuzzer']
asn_build_string	36	17	47.22%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_trap_fuzzer']
asn_realloc_rbuild_length	43	17	39.53%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_trap_fuzzer']
asn_realloc_rbuild_string	52	20	38.46%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_trap_fuzzer']
asn_realloc_rbuild_bitstring	53	19	35.84%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_trap_fuzzer']
snmp_pdu_realloc_rbuild	163	67	41.10%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_trap_fuzzer']
snmpv3_build	139	49	35.25%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_trap_fuzzer']
_check_range	39	11	28.20%	['snmp_agent_e2e_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer']
netsnmp_register_handler	54	18	33.33%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
netsnmp_subtree_join	36	8	22.22%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
netsnmp_subtree_load	128	63	49.21%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
netsnmp_register_mib	134	68	50.74%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
unregister_mibs_by_session	47	23	48.93%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
unregister_mib_table_row_session	67	31	46.26%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
close_agentx_session	48	26	54.16%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
register_agentx_list	51	12	23.52%	['agentx_master_fuzzer']
vacm_parse_view	74	39	52.70%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
snmp_error	36	19	52.77%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer', 'snmp_parse_trap_fuzzer']
_sess_async_send	117	38	32.47%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_parse_trap_fuzzer']
netsnmp_call_handler	38	18	47.36%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
in_a_view	35	5	14.28%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
handle_snmp_packet	66	24	36.36%	['snmp_agent_e2e_fuzzer']
check_acm	48	26	54.16%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
check_getnext_results	56	10	17.85%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
handle_getnext_loop	62	15	24.19%	['snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
netsnmp_handle_request	61	21	34.42%	['snmp_agent_e2e_fuzzer']
unregister_config_handler	56	22	39.28%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_sd_listen_fds	58	13	22.41%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_sock_buffer_set	53	24	45.28%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_udpipv4base_transport_init	46	17	36.95%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_udpipv4base_transport_bind	51	19	37.25%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer']
netsnmp_udpipv4base_transport_with_source	47	25	53.19%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer']
parse_octet_hint	91	22	24.17%	['snmp_agent_e2e_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'read_objid_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_config_mem_fuzzer', 'parse_octet_hint_fuzzer', 'snmp_print_var_fuzzer']
sprint_realloc_octet_string	252	49	19.44%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_float	37	18	48.64%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_double	37	18	48.64%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_counter64	73	32	43.83%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_opaque	57	20	35.08%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_object_identifier	32	15	46.87%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_timeticks	39	20	51.28%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_integer	60	28	46.66%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_uinteger	55	25	45.45%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_gauge	38	15	39.47%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
sprint_realloc_bitstring	75	34	45.33%	['snmp_parse_trap2_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_fuzzer', 'agentx_master_fuzzer', 'snmp_e2e_fuzzer', 'agentx_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
netsnmp_get_traphandler	39	12	30.76%	['snmp_parse_trap_fuzzer']
snmp_sess_select_info2_flags	107	39	36.44%	['snmp_parse_trap2_fuzzer', 'snmp_agent_e2e_fuzzer', 'agentx_master_fuzzer']
usm_rgenerate_out_msg	296	130	43.91%	['snmp_parse_trap2_fuzzer']
netsnmp_udpbase_send	51	22	43.13%	['snmp_parse_trap2_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/net-snmp/snmplib/file_utils.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	[]
/src/net-snmp/agent/helpers/table.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/snmplib/large_fd_set.c	['snmp_e2e_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/usr/include/openssl/x509.h	[]	[]
/src/net-snmp/snmplib/transports/snmpIPXDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/lcd_time.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpAliasDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/agent_index.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer']
/src/net-snmp/agent/mibgroup/smux/smux.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpCallbackDomain.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_auth.c	['snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_sec_models_fuzzer.c	['snmp_sec_models_fuzzer']	['snmp_sec_models_fuzzer']
/src/net-snmp/agent/helpers/serialize.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmpv3.c	['snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/asn1.c	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/snmp_version.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_parse_args_fuzzer']
/src/net-snmp/agent/helpers/stash_cache.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_print_var_fuzzer.c	['snmp_print_var_fuzzer']	['snmp_print_var_fuzzer']
/src/net-snmp/snmplib/snmp_logging.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/helpers/bulk_to_next.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/agentx_master_fuzzer.c	['agentx_master_fuzzer']	['agentx_master_fuzzer']
/src/net-snmp/snmplib/snmp_transport.c	['snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpIPBaseDomain.c	['snmp_transport_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_transport_fuzzer', 'snmp_agent_e2e_fuzzer']
/usr/include/openssl/x509_vfy.h	[]	[]
/src/net-snmp/agent/helpers/read_only.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/dir_utils.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	[]
/src/net-snmp/snmplib/strlcat.c	['snmp_config_mem_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_mib_fuzzer', 'snmp_config_fuzzer', 'snmp_print_var_fuzzer']
/src/net-snmp/snmplib/transports/snmpDTLSUDPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/snmp_agent.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPIPv6Domain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpTLSBaseDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/sd-daemon.c	[]	[]
/src/net-snmp/snmplib/transports/snmpUDPIPv4BaseDomain.c	[]	[]
/src/net-snmp/testing/fuzzing/snmp_parse_args_fuzzer.c	['snmp_parse_args_fuzzer']	['snmp_parse_args_fuzzer']
/src/net-snmp/snmplib/snmp_enum.c	['snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpTCPBaseDomain.c	[]	[]
/src/net-snmp/testing/fuzzing/agentx_parse_fuzzer.c	['agentx_parse_fuzzer']	['agentx_parse_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_api_fuzzer.c	['snmp_api_fuzzer']	['snmp_api_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_config_mem_fuzzer.c	['snmp_config_mem_fuzzer']	['snmp_config_mem_fuzzer']
/src/net-snmp/snmplib/read_config.c	['snmp_config_mem_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/agent_read_config.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/netsnmp_close_fds.c	[]	[]
/src/net-snmp/snmplib/snmp.c	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/snmp_secmod.c	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/agent_trap.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/kernel.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpSocketBaseDomain.c	[]	[]
/src/net-snmp/snmplib/snmpksm.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_scoped_pdu_parse_fuzzer.c	['snmp_scoped_pdu_parse_fuzzer']	['snmp_scoped_pdu_parse_fuzzer']
/src/net-snmp/agent/helpers/old_api.c	[]	[]
/src/net-snmp/agent/mibgroup/utilities/iquery.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/helpers/row_merge.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_alarm.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/subagent.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/snmplib/callback.c	['snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/helpers/scalar.c	[]	[]
/src/net-snmp/snmplib/parse.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/../include/net-snmp/library/tools.h	['snmp_pdu_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	[]
/src/net-snmp/snmplib/oid_stash.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/testing/fuzzing/snmp_config_fuzzer.c	['snmp_config_fuzzer']	['snmp_config_fuzzer']
/src/net-snmp/agent/helpers/instance.c	[]	[]
/src/net-snmp/agent/agent_registry.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_debug.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/vacm.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/helpers/table_dataset.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/mibgroup/utilities/execute.c	[]	[]
/src/net-snmp/snmplib/container_binary_array.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/agent_handler.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/int64.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_e2e_fuzzer', 'snmp_api_fuzzer', 'snmp_print_var_fuzzer']
/src/net-snmp/agent/helpers/debug_handler.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpAAL5PVCDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/master.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_parse_fuzzer.c	['snmp_parse_fuzzer']	['snmp_parse_fuzzer']
/usr/include/openssl/x509v3.h	[]	[]
/src/net-snmp/apps/snmptrapd_handlers.c	['snmp_parse_trap_fuzzer']	['snmp_parse_trap_fuzzer']
/src/net-snmp/snmplib/snmpusm.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/snmp_openssl.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpIPv4BaseDomain.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpTCPIPv6Domain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/snmp-tc.c	[]	[]
/src/net-snmp/snmplib/snmp_client.c	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_pdu_parse_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/agent_sysORTable.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpTLSTCPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/helpers/watcher.c	[]	[]
/src/net-snmp/agent/helpers/stash_to_next.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_e2e_fuzzer.c	['snmp_e2e_fuzzer']	['snmp_e2e_fuzzer']
/src/net-snmp/apps/snmptrapd_log.c	[]	[]
/src/net-snmp/agent/mibgroup/agentx/master_admin.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer']
/src/net-snmp/agent/mibgroup/snmpv3/usmConf.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/agentx_config.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/apps/snmptrapd_auth.c	['snmp_parse_trap_fuzzer']	[]
/src/net-snmp/snmplib/transports/snmpUnixDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_parse_trap2_fuzzer.c	['snmp_parse_trap2_fuzzer']	['snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/client.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/agent/helpers/cache_handler.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_parse_args.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer']
/src/net-snmp/agent/helpers/all_helpers.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_parse_trap_fuzzer.c	['snmp_parse_trap_fuzzer']	['snmp_parse_trap_fuzzer']
/src/net-snmp/agent/mibgroup/agentx/protocol.c	['snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer']	['snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer']
/src/net-snmp/snmplib/mib.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'parse_octet_hint_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'parse_octet_hint_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpSTDDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/snmp_service.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/data_list.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/cert_util.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/snmptsm.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/read_objid_fuzzer.c	['read_objid_fuzzer']	['read_objid_fuzzer']
/src/net-snmp/agent/snmp_vars.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/snmp_api.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_mib_fuzzer.c	['snmp_mib_fuzzer']	['snmp_mib_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPsharedDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/default_store.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/parse_octet_hint_fuzzer.c	['parse_octet_hint_fuzzer']	['parse_octet_hint_fuzzer']
/src/net-snmp/agent/helpers/table_data.c	['snmp_agent_e2e_fuzzer']	[]
/src/net-snmp/snmplib/transports/snmpIPv6BaseDomain.c	['snmp_transport_fuzzer']	['snmp_transport_fuzzer']
/src/net-snmp/testing/fuzzing/ada_fuzz_header.h	['snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']	['snmp_transport_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_api_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer']
/src/net-snmp/snmplib/tools.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_transport_fuzzer.c	['snmp_transport_fuzzer']	['snmp_transport_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_pdu_parse_fuzzer.c	['snmp_pdu_parse_fuzzer']	['snmp_pdu_parse_fuzzer']
/src/net-snmp/agent/helpers/null.c	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']	['agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/system.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_agent_e2e_fuzzer.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/transports/snmpTCPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/container_null.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPDomain.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/container.c	['snmp_transport_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_sec_models_fuzzer', 'agentx_master_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/agent/mibgroup/mibII/vacm_conf.c	['snmp_agent_e2e_fuzzer']	['snmp_agent_e2e_fuzzer']
/src/net-snmp/snmplib/keytools.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_parse_args_fuzzer']
/src/net-snmp/agent/mibgroup/notification-log-mib/notification_log.c	[]	[]
/src/net-snmp/snmplib/strlcpy.c	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'agentx_parse_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_config_mem_fuzzer', 'snmp_pdu_parse_fuzzer', 'snmp_parse_oid_fuzzer', 'snmp_transport_fuzzer', 'snmp_parse_fuzzer', 'snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_scoped_pdu_parse_fuzzer', 'snmp_sec_models_fuzzer', 'snmp_api_fuzzer', 'snmp_mib_fuzzer', 'agentx_master_fuzzer', 'snmp_config_fuzzer', 'snmp_agent_e2e_fuzzer', 'read_objid_fuzzer', 'snmp_print_var_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/testing/fuzzing/snmp_parse_oid_fuzzer.c	['snmp_parse_oid_fuzzer']	['snmp_parse_oid_fuzzer']
/src/net-snmp/snmplib/fd_event_manager.c	[]	[]
/src/net-snmp/snmplib/scapi.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/container_list_ssll.c	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']	['snmp_e2e_fuzzer', 'snmp_parse_args_fuzzer', 'snmp_agent_e2e_fuzzer', 'snmp_parse_trap2_fuzzer']
/src/net-snmp/snmplib/transports/snmpUDPBaseDomain.c	[]	[]

Directories in report

Directory
/src/net-snmp/agent/mibgroup/notification-log-mib/
/src/net-snmp/snmplib/../include/net-snmp/library/
/src/net-snmp/snmplib/transports/
/src/net-snmp/snmplib/
/src/net-snmp/agent/mibgroup/smux/
/src/net-snmp/agent/mibgroup/snmpv3/
/usr/include/openssl/
/src/net-snmp/agent/
/src/net-snmp/testing/fuzzing/
/src/net-snmp/agent/mibgroup/utilities/
/src/net-snmp/agent/helpers/
/src/net-snmp/apps/
/src/net-snmp/agent/mibgroup/agentx/
/src/net-snmp/agent/mibgroup/mibII/