Fuzz introspector: mpi-sqrmod
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
95 127 5 :

['s_mp_div_d', 'mp_clear', 's_mp_exch', 's_mp_cmp_d', 'mp_init_copy']

95 127 mp_div_d call site: 00079 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:562
2 29 3 :

['s_mp_clamp', 's_mpv_mul_set_vec64', 's_mp_pad']

2 29 s_mp_mul_d call site: 00026 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:3591
0 15 4 :

['s_mp_alloc', 's_mp_copy', 's_mp_setz', 's_mp_free']

0 15 mp_copy call site: 00017 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:204
0 5 1 :

['mp_zero']

0 5 mp_mul_d call site: 00014 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:504
0 2 1 :

['s_mp_setz']

0 2 s_mp_rshd call site: 00082 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:3279
0 0 None 2 79 s_mp_mul_d call site: 00024 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:3585
0 0 None 0 9 mp_add_d call site: 00051 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:418
0 0 None 0 9 mp_toradix call site: 00077 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:2949
0 0 None 0 9 mp_toradix call site: 00105 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:2961
0 0 4 :

['std::__1::basic_ostream >& std::__1::operator<<[abi:v180000] , std::__1::allocator >(std::__1::basic_ostream >&, std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::basic_ostream >::operator<<[abi:v180000](std::__1::basic_ostream >& (*)(std::__1::basic_ostream >&))', 'std::__1::basic_ostream >& std::__1::operator<<[abi:v180000] >(std::__1::basic_ostream >&, char const*)', 'std::__1::basic_ostream >::operator<<[abi:v180000](std::__1::ios_base& (*)(std::__1::ios_base&))']

0 0 check_equal(bignum_st*,mp_int*,unsignedlong) call site: 00000 /src/nss/out/Debug/../../fuzz/mpi_helper.cc:36
0 0 None 0 0 mp_init_size call site: 00005 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:144
0 0 None 0 0 mp_init_copy call site: 00048 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:172

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 BN_CTX_new [call site] 00001
1 mp_init [function] [call site] 00002
2 mp_init_size [function] [call site] 00003
3 __assert_fail [call site] 00004
3 s_mp_alloc [function] [call site] 00005
4 calloc [call site] 00006
1 parse_input(unsigned char const*, unsigned long, bignum_st*, mp_int*) [function] [call site] 00007
2 to_char(unsigned char const*) [function] [call site] 00008
2 mp_read_raw [function] [call site] 00009
3 __assert_fail [call site] 00010
3 mp_zero [function] [call site] 00011
4 s_mp_setz [function] [call site] 00012
3 mp_mul_d [function] [call site] 00013
4 __assert_fail [call site] 00014
4 mp_zero [function] [call site] 00015
4 mp_copy [function] [call site] 00016
5 __assert_fail [call site] 00017
5 s_mp_setz [function] [call site] 00018
5 s_mp_copy [function] [call site] 00019
5 s_mp_alloc [function] [call site] 00020
5 s_mp_copy [function] [call site] 00021
5 s_mp_setz [function] [call site] 00022
5 s_mp_free [function] [call site] 00023
4 s_mp_mul_d [function] [call site] 00024
5 mp_zero [function] [call site] 00025
5 s_mp_ispow2d [function] [call site] 00026
5 s_mp_mul_2d [function] [call site] 00027
6 __assert_fail [call site] 00028
6 s_mp_pad [function] [call site] 00029
7 __assert_fail [call site] 00030
7 s_mp_grow [function] [call site] 00031
8 __assert_fail [call site] 00032
8 s_mp_alloc [function] [call site] 00033
8 s_mp_copy [function] [call site] 00034
8 s_mp_setz [function] [call site] 00035
8 s_mp_free [function] [call site] 00036
7 s_mp_setz [function] [call site] 00037
6 s_mp_lshd [function] [call site] 00038
7 __assert_fail [call site] 00039
7 s_mp_pad [function] [call site] 00040
6 s_mp_clamp [function] [call site] 00041
5 s_mp_pad [function] [call site] 00042
5 s_mpv_mul_set_vec64 [call site] 00043
5 s_mp_clamp [function] [call site] 00044
3 mp_add_d [function] [call site] 00045
4 __assert_fail [call site] 00046
4 mp_init_copy [function] [call site] 00047
5 __assert_fail [call site] 00048
5 s_mp_alloc [function] [call site] 00049
5 s_mp_copy [function] [call site] 00050
4 s_mp_add_d [function] [call site] 00051
5 s_mp_pad [function] [call site] 00052
4 s_mp_cmp_d [function] [call site] 00053
5 __assert_fail [call site] 00054
4 s_mp_sub_d [function] [call site] 00055
5 s_mp_clamp [function] [call site] 00056
4 mp_neg [function] [call site] 00057
5 __assert_fail [call site] 00058
5 mp_copy [function] [call site] 00059
5 s_mp_cmp_d [function] [call site] 00060
4 s_mp_cmp_d [function] [call site] 00061
4 s_mp_exch [function] [call site] 00062
4 mp_clear [function] [call site] 00063
5 s_mp_setz [function] [call site] 00064
5 s_mp_free [function] [call site] 00065
2 __assert_fail [call site] 00066
2 BN_bin2bn [call site] 00067
2 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00068
3 BN_bn2hex [call site] 00069
3 mp_toradix [function] [call site] 00070
4 __assert_fail [call site] 00071
4 __assert_fail [call site] 00072
4 mp_cmp_z [function] [call site] 00073
5 __assert_fail [call site] 00074
4 mp_init_copy [function] [call site] 00075
4 mp_cmp_z [function] [call site] 00076
4 mp_div_d [function] [call site] 00077
5 __assert_fail [call site] 00078
5 s_mp_ispow2d [function] [call site] 00079
5 mp_copy [function] [call site] 00080
5 s_mp_div_2d [function] [call site] 00081
6 s_mp_rshd [function] [call site] 00082
7 s_mp_setz [function] [call site] 00083
6 s_mp_clamp [function] [call site] 00084
5 mp_init_copy [function] [call site] 00085
5 s_mp_div_d [function] [call site] 00086
6 mp_init_size [function] [call site] 00087
6 mp_init_copy [function] [call site] 00088
6 s_mp_norm [function] [call site] 00089
7 __assert_fail [call site] 00090
7 s_mp_mul_2d [function] [call site] 00091
7 s_mp_mul_2d [function] [call site] 00092
6 s_mpv_div_2dx1d [function] [call site] 00093
6 s_mp_lshd [function] [call site] 00094
6 s_mp_clamp [function] [call site] 00095
6 mp_exch [function] [call site] 00096
7 __assert_fail [call site] 00097
7 s_mp_exch [function] [call site] 00098
6 mp_clear [function] [call site] 00099
6 mp_clear [function] [call site] 00100
5 s_mp_cmp_d [function] [call site] 00101
5 s_mp_exch [function] [call site] 00102
5 mp_clear [function] [call site] 00103
4 mp_clear [function] [call site] 00104
4 s_mp_todigit [function] [call site] 00105
5 tolower [call site] 00106
4 mp_clear [function] [call site] 00107
3 CRYPTO_free [call site] 00108
3 __assert_fail [call site] 00109
1 mp_cmp_z [function] [call site] 00110
1 mp_clear [function] [call site] 00111
1 mp_clear [function] [call site] 00112
1 mp_clear [function] [call site] 00113
1 BN_CTX_end [call site] 00114
1 BN_CTX_free [call site] 00115
1 mp_sqrmod [function] [call site] 00116
2 __assert_fail [call site] 00117
2 mp_sqr [function] [call site] 00118
3 __assert_fail [call site] 00119
3 mp_init_copy [function] [call site] 00120
3 s_mp_grow [function] [call site] 00121
3 s_mp_sqr_comba_4 [function] [call site] 00122
3 s_mp_sqr_comba_8 [function] [call site] 00123
3 s_mp_sqr_comba_16 [function] [call site] 00124
3 s_mp_sqr_comba_32 [function] [call site] 00125
3 s_mpv_mul_set_vec64 [call site] 00126
3 s_mpv_mul_add_vec64 [call site] 00127
3 s_mp_mul_2 [function] [call site] 00128
4 __assert_fail [call site] 00129
4 s_mp_grow [function] [call site] 00130
3 s_mpv_sqr_add_prop [function] [call site] 00131
3 s_mp_clamp [function] [call site] 00132
3 mp_clear [function] [call site] 00133
2 mp_mod [function] [call site] 00134
3 __assert_fail [call site] 00135
3 s_mp_cmp [function] [call site] 00136
4 __assert_fail [call site] 00137
3 mp_div [function] [call site] 00138
4 __assert_fail [call site] 00139
4 mp_cmp_z [function] [call site] 00140
4 mp_init_copy [function] [call site] 00141
4 mp_copy [function] [call site] 00142
4 mp_init_size [function] [call site] 00143
4 s_mp_pad [function] [call site] 00144
4 mp_zero [function] [call site] 00145
4 s_mp_cmp [function] [call site] 00146
4 mp_zero [function] [call site] 00147
4 mp_set [function] [call site] 00148
5 mp_zero [function] [call site] 00149
4 mp_zero [function] [call site] 00150
4 mp_init_copy [function] [call site] 00151
4 s_mp_div [function] [call site] 00152
5 mp_cmp_z [function] [call site] 00153
5 s_mp_ispow2 [function] [call site] 00154
6 __assert_fail [call site] 00155
6 s_mp_ispow2d [function] [call site] 00156
5 mp_copy [function] [call site] 00157
5 s_mp_div_2d [function] [call site] 00158
5 s_mp_mod_2d [function] [call site] 00159
6 s_mp_clamp [function] [call site] 00160
5 mp_init_size [function] [call site] 00161
5 s_mp_norm [function] [call site] 00162
5 s_mp_cmp [function] [call site] 00163
5 s_mp_cmp [function] [call site] 00164
5 __assert_fail [call site] 00165
5 s_mpv_div_2dx1d [function] [call site] 00166
5 __assert_fail [call site] 00167
5 mp_copy [function] [call site] 00168
5 s_mp_mul_d [function] [call site] 00169
5 s_mp_cmp [function] [call site] 00170
5 s_mp_sub [function] [call site] 00171
6 s_mp_clamp [function] [call site] 00172
5 s_mp_sub [function] [call site] 00173
5 s_mp_clamp [function] [call site] 00174
5 s_mp_div_2d [function] [call site] 00175
5 s_mp_clamp [function] [call site] 00176
5 mp_clear [function] [call site] 00177
4 s_mp_cmp_d [function] [call site] 00178
4 s_mp_cmp_d [function] [call site] 00179
4 s_mp_exch [function] [call site] 00180
4 s_mp_exch [function] [call site] 00181
4 mp_clear [function] [call site] 00182
4 mp_clear [function] [call site] 00183
4 mp_clear [function] [call site] 00184
3 mp_add [function] [call site] 00185
4 __assert_fail [call site] 00186
4 s_mp_add_3arg [function] [call site] 00187
5 s_mp_pad [function] [call site] 00188
5 s_mp_pad [function] [call site] 00189
4 s_mp_cmp [function] [call site] 00190
4 s_mp_sub_3arg [function] [call site] 00191
5 s_mp_pad [function] [call site] 00192
5 s_mp_clamp [function] [call site] 00193
4 s_mp_sub_3arg [function] [call site] 00194
4 s_mp_cmp_d [function] [call site] 00195
3 mp_copy [function] [call site] 00196
3 mp_cmp_z [function] [call site] 00197
3 mp_add [function] [call site] 00198
3 mp_zero [function] [call site] 00199
1 __assert_fail [call site] 00200
1 BN_mod_sqr [call site] 00201
1 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00202
1 mp_clear [function] [call site] 00203
1 BN_CTX_end [call site] 00204