Fuzz introspector: mpi-expmod
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
580 580 1 :

['mp_exptmod_i']

580 598 mp_exptmod call site: 00296 /src/nss/out/Debug/../../lib/freebl/mpi/mpmontg.c:1144
95 127 5 :

['s_mp_div_d', 'mp_clear', 's_mp_exch', 's_mp_cmp_d', 'mp_init_copy']

95 127 mp_div_d call site: 00083 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:562
30 30 1 :

['s_mp_add_3arg']

30 37 mp_add call site: 00193 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:746
30 30 1 :

['s_mp_add_3arg']

30 37 mp_sub call site: 00238 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:785
23 23 1 :

['getIntelCacheLineSize']

23 23 s_mpi_getProcessorLineSize call site: 00298 /src/nss/out/Debug/../../lib/freebl/mpi/mpcpucache.c:691
0 71 1 :

['mp_add']

0 71 mp_mod call site: 00145 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:1305
0 71 1 :

['mp_add']

0 71 mp_mod call site: 00204 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:1314
0 17 1 :

['s_mp_grow']

4 84 mp_sqr call site: 00258 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:991
0 17 1 :

['s_mp_grow']

0 17 s_mp_mul_2 call site: 00267 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:3338
0 13 1 :

['mp_init_copy']

4 97 mp_sqr call site: 00257 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:981
0 8 1 :

['mp_set']

0 60 mp_div call site: 00153 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:1105
0 7 2 :

['s_mp_alloc', 's_mp_free']

0 11 mp_copy call site: 00017 /src/nss/out/Debug/../../lib/freebl/mpi/mpi.c:217

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 BN_CTX_new [call site] 00001
1 mp_init [function] [call site] 00002
2 mp_init_size [function] [call site] 00003
3 __assert_fail [call site] 00004
3 s_mp_alloc [function] [call site] 00005
4 calloc [call site] 00006
1 parse_input(unsigned char const*, unsigned long, bignum_st*, bignum_st*, mp_int*, mp_int*) [function] [call site] 00007
2 to_char(unsigned char const*) [function] [call site] 00008
2 mp_read_raw [function] [call site] 00009
3 __assert_fail [call site] 00010
3 mp_mul_d [function] [call site] 00013
4 __assert_fail [call site] 00014
4 mp_copy [function] [call site] 00016
5 __assert_fail [call site] 00017
5 s_mp_setz [function] [call site] 00018
5 s_mp_copy [function] [call site] 00019
5 s_mp_alloc [function] [call site] 00020
5 s_mp_copy [function] [call site] 00021
5 s_mp_setz [function] [call site] 00022
5 s_mp_free [function] [call site] 00023
4 s_mp_mul_d [function] [call site] 00024
5 s_mp_ispow2d [function] [call site] 00026
5 s_mp_mul_2d [function] [call site] 00027
6 __assert_fail [call site] 00028
6 s_mp_pad [function] [call site] 00029
7 __assert_fail [call site] 00030
7 s_mp_grow [function] [call site] 00031
8 __assert_fail [call site] 00032
8 s_mp_alloc [function] [call site] 00033
8 s_mp_copy [function] [call site] 00034
8 s_mp_setz [function] [call site] 00035
8 s_mp_free [function] [call site] 00036
7 s_mp_setz [function] [call site] 00037
6 s_mp_lshd [function] [call site] 00038
7 __assert_fail [call site] 00039
6 s_mp_clamp [function] [call site] 00041
5 s_mpv_mul_set_vec64 [call site] 00043
5 s_mp_clamp [function] [call site] 00044
3 mp_add_d [function] [call site] 00045
4 __assert_fail [call site] 00046
4 mp_init_copy [function] [call site] 00047
5 __assert_fail [call site] 00048
5 s_mp_alloc [function] [call site] 00049
5 s_mp_copy [function] [call site] 00050
4 s_mp_cmp_d [function] [call site] 00053
5 __assert_fail [call site] 00054
4 s_mp_sub_d [function] [call site] 00055
5 s_mp_clamp [function] [call site] 00056
4 mp_neg [function] [call site] 00057
5 __assert_fail [call site] 00058
5 s_mp_cmp_d [function] [call site] 00060
4 s_mp_cmp_d [function] [call site] 00061
4 s_mp_exch [function] [call site] 00062
2 __assert_fail [call site] 00066
2 to_char(unsigned char const*) [function] [call site] 00067
2 mp_read_raw [function] [call site] 00068
2 __assert_fail [call site] 00069
2 BN_bin2bn [call site] 00070
2 BN_bin2bn [call site] 00071
2 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00072
3 BN_bn2hex [call site] 00073
3 mp_toradix [function] [call site] 00074
4 __assert_fail [call site] 00075
4 __assert_fail [call site] 00076
4 mp_cmp_z [function] [call site] 00077
5 __assert_fail [call site] 00078
4 mp_init_copy [function] [call site] 00079
4 mp_div_d [function] [call site] 00081
5 __assert_fail [call site] 00082
5 s_mp_ispow2d [function] [call site] 00083
5 s_mp_div_2d [function] [call site] 00085
6 s_mp_clamp [function] [call site] 00088
5 mp_init_copy [function] [call site] 00089
5 s_mp_div_d [function] [call site] 00090
6 mp_init_size [function] [call site] 00091
6 mp_init_copy [function] [call site] 00092
6 s_mp_norm [function] [call site] 00093
7 __assert_fail [call site] 00094
7 s_mp_mul_2d [function] [call site] 00095
7 s_mp_mul_2d [function] [call site] 00096
6 s_mpv_div_2dx1d [function] [call site] 00097
6 s_mp_lshd [function] [call site] 00098
6 s_mp_clamp [function] [call site] 00099
6 mp_exch [function] [call site] 00100
7 __assert_fail [call site] 00101
7 s_mp_exch [function] [call site] 00102
5 s_mp_cmp_d [function] [call site] 00105
5 s_mp_exch [function] [call site] 00106
4 s_mp_todigit [function] [call site] 00109
5 tolower [call site] 00110
3 CRYPTO_free [call site] 00112
3 __assert_fail [call site] 00113
2 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00114
1 get_modulus(unsigned char const*, unsigned long, bignum_ctx*) [function] [call site] 00115
2 BN_CTX_get [call site] 00116
2 __assert_fail [call site] 00118
2 to_char(unsigned char const*) [function] [call site] 00119
2 mp_read_raw [function] [call site] 00120
2 __assert_fail [call site] 00121
2 BN_bin2bn [call site] 00122
2 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00123
2 BN_set_word [call site] 00126
2 BN_add_word [call site] 00128
1 BN_rshift [call site] 00129
1 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00130
1 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00131
1 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00132
1 mp_exptmod [function] [call site] 00133
2 mp_isodd [function] [call site] 00134
3 __assert_fail [call site] 00135
2 s_mp_exptmod [function] [call site] 00136
3 __assert_fail [call site] 00137
3 mp_init_copy [function] [call site] 00140
3 mp_mod [function] [call site] 00141
4 __assert_fail [call site] 00142
4 s_mp_cmp [function] [call site] 00143
5 __assert_fail [call site] 00144
4 mp_div [function] [call site] 00145
5 __assert_fail [call site] 00146
5 mp_init_copy [function] [call site] 00148
5 mp_init_size [function] [call site] 00150
5 mp_init_copy [function] [call site] 00158
5 s_mp_div [function] [call site] 00159
6 s_mp_ispow2 [function] [call site] 00161
7 __assert_fail [call site] 00162
7 s_mp_ispow2d [function] [call site] 00163
6 s_mp_div_2d [function] [call site] 00165
6 s_mp_mod_2d [function] [call site] 00166
7 s_mp_clamp [function] [call site] 00167
6 mp_init_size [function] [call site] 00168
6 s_mp_norm [function] [call site] 00169
6 __assert_fail [call site] 00172
6 s_mpv_div_2dx1d [function] [call site] 00173
6 __assert_fail [call site] 00174
6 s_mp_mul_d [function] [call site] 00176
6 s_mp_clamp [function] [call site] 00181
6 s_mp_div_2d [function] [call site] 00182
6 s_mp_clamp [function] [call site] 00183
5 s_mp_cmp_d [function] [call site] 00185
5 s_mp_cmp_d [function] [call site] 00186
5 s_mp_exch [function] [call site] 00187
5 s_mp_exch [function] [call site] 00188
4 mp_add [function] [call site] 00192
5 __assert_fail [call site] 00193
5 s_mp_add_3arg [function] [call site] 00194
5 s_mp_sub_3arg [function] [call site] 00198
5 s_mp_sub_3arg [function] [call site] 00201
5 s_mp_cmp_d [function] [call site] 00202
3 s_mp_add_d [function] [call site] 00209
3 s_mp_lshd [function] [call site] 00210
3 s_mp_mul [function] [call site] 00212
4 mp_mul [function] [call site] 00213
5 s_mp_mulg [function] [call site] 00214
6 __assert_fail [call site] 00215
6 mp_init_copy [function] [call site] 00216
6 mp_init_copy [function] [call site] 00217
6 s_mp_mul_comba_4 [function] [call site] 00219
6 s_mp_mul_comba_8 [function] [call site] 00220
6 s_mp_mul_comba_16 [function] [call site] 00221
6 s_mp_mul_comba_32 [function] [call site] 00222
6 s_mpv_mul_set_vec64 [call site] 00223
6 s_mpv_mul_add_vec64 [call site] 00224
6 s_mp_clamp [function] [call site] 00225
6 s_mp_cmp_d [function] [call site] 00226
3 s_mp_reduce [function] [call site] 00228
4 mp_init_copy [function] [call site] 00229
4 s_mp_rshd [function] [call site] 00230
4 s_mp_rshd [function] [call site] 00232
4 s_mp_mod_2d [function] [call site] 00233
4 s_mp_mod_2d [function] [call site] 00235
4 mp_sub [function] [call site] 00236
5 __assert_fail [call site] 00237
5 s_mp_add_3arg [function] [call site] 00239
5 s_mp_sub_3arg [function] [call site] 00242
5 s_mp_sub_3arg [function] [call site] 00243
5 s_mp_cmp_d [function] [call site] 00244
4 s_mp_lshd [function] [call site] 00247
4 mp_cmp [function] [call site] 00249
5 __assert_fail [call site] 00250
3 s_mp_sqr [function] [call site] 00254
4 mp_init_size [function] [call site] 00255
4 mp_sqr [function] [call site] 00256
5 __assert_fail [call site] 00257
5 mp_init_copy [function] [call site] 00258
5 s_mp_grow [function] [call site] 00259
5 s_mp_sqr_comba_4 [function] [call site] 00260
5 s_mp_sqr_comba_8 [function] [call site] 00261
5 s_mp_sqr_comba_16 [function] [call site] 00262
5 s_mp_sqr_comba_32 [function] [call site] 00263
5 s_mpv_mul_set_vec64 [call site] 00264
5 s_mpv_mul_add_vec64 [call site] 00265
5 s_mp_mul_2 [function] [call site] 00266
6 __assert_fail [call site] 00267
6 s_mp_grow [function] [call site] 00268
5 s_mpv_sqr_add_prop [function] [call site] 00269
5 s_mp_clamp [function] [call site] 00270
4 s_mp_exch [function] [call site] 00272
3 s_mp_reduce [function] [call site] 00274
3 s_mp_reduce [function] [call site] 00276
3 s_mp_reduce [function] [call site] 00278
3 s_mp_exch [function] [call site] 00279
2 mp_init_size [function] [call site] 00287
2 mp_calculate_mont_n0i [function] [call site] 00288
3 s_mp_invmod_radix [function] [call site] 00289
2 mpl_significant_bits [function] [call site] 00294
3 __assert_fail [call site] 00295
2 s_mpi_getProcessorLineSize [function] [call site] 00296
3 freebl_cpuid [function] [call site] 00297
3 strcmp [call site] 00298
3 getIntelCacheLineSize [function] [call site] 00299
4 freebl_cpuid [function] [call site] 00300
4 getIntelRegisterCacheLineSize [function] [call site] 00301
5 getIntelCacheEntryLineSize [function] [call site] 00302
5 getIntelCacheEntryLineSize [function] [call site] 00303
5 getIntelCacheEntryLineSize [function] [call site] 00304
5 getIntelCacheEntryLineSize [function] [call site] 00305
4 getIntelRegisterCacheLineSize [function] [call site] 00306
4 getIntelRegisterCacheLineSize [function] [call site] 00307
4 getIntelRegisterCacheLineSize [function] [call site] 00308
4 freebl_cpuid [function] [call site] 00309
3 getOtherCacheLineSize [function] [call site] 00310
4 freebl_cpuid [function] [call site] 00311
4 freebl_cpuid [function] [call site] 00312
2 mp_exptmod_safe_i [function] [call site] 00313
3 mpl_get_bits [function] [call site] 00314
4 __assert_fail [call site] 00315
4 __assert_fail [call site] 00316
3 mp_init_size [function] [call site] 00317
3 mp_init_size [function] [call site] 00318
3 mp_init_size [function] [call site] 00319
3 mp_init_size [function] [call site] 00320
3 mp_init_size [function] [call site] 00321
3 mp_init_size [function] [call site] 00322
3 mp_to_mont [function] [call site] 00324
3 s_mp_redc [function] [call site] 00327
4 s_mpv_mul_d_add_prop [function] [call site] 00329
5 s_mpv_mul_add_vec64 [call site] 00330
4 s_mp_clamp [function] [call site] 00331
4 s_mp_rshd [function] [call site] 00332
3 s_mp_mul_mont [function] [call site] 00335
4 __assert_fail [call site] 00336
4 s_mpv_mul_set_vec64 [call site] 00338
4 s_mp_setz [function] [call site] 00339
4 s_mpv_mul_d_add_prop [function] [call site] 00340
4 s_mpv_mul_d_add_prop [function] [call site] 00341
4 s_mpv_mul_d_add_prop [function] [call site] 00342
4 s_mpv_mul_d_add_prop [function] [call site] 00343
4 s_mp_clamp [function] [call site] 00344
4 s_mp_rshd [function] [call site] 00345
3 mpi_to_weave [function] [call site] 00347
4 __assert_fail [call site] 00348
4 __assert_fail [call site] 00349
3 mp_to_mont [function] [call site] 00352
3 s_mp_mul_mont [function] [call site] 00354
3 mpi_to_weave [function] [call site] 00355
3 weave_to_mpi [function] [call site] 00357
4 __assert_fail [call site] 00358
4 s_mp_clamp [function] [call site] 00359
3 s_mp_redc [function] [call site] 00361
3 s_mp_redc [function] [call site] 00364
3 s_mp_redc [function] [call site] 00366
3 __assert_fail [call site] 00367
3 mp_init_size [function] [call site] 00368
3 mpl_get_bits [function] [call site] 00369
3 s_mp_redc [function] [call site] 00371
3 s_mp_redc [function] [call site] 00373
3 s_mp_mul_mont [function] [call site] 00374
3 s_mp_redc [function] [call site] 00376
3 s_mp_redc [function] [call site] 00378
3 s_mp_redc [function] [call site] 00380
3 s_mp_redc [function] [call site] 00382
3 s_mp_redc [function] [call site] 00384
3 s_mp_redc [function] [call site] 00386
3 weave_to_mpi [function] [call site] 00387
3 s_mp_redc [function] [call site] 00389
3 s_mp_redc [function] [call site] 00391
3 s_mp_redc [function] [call site] 00393
3 s_mp_redc [function] [call site] 00395
3 s_mp_redc [function] [call site] 00397
3 weave_to_mpi [function] [call site] 00398
3 abort [call site] 00399
3 s_mp_redc [function] [call site] 00400
2 mp_exptmod_i [function] [call site] 00409
3 mp_init_size [function] [call site] 00410
3 mp_init_size [function] [call site] 00411
3 mp_init_copy [function] [call site] 00412
3 mp_init_size [function] [call site] 00413
3 s_mp_redc [function] [call site] 00415
3 mp_init_size [function] [call site] 00416
3 s_mp_redc [function] [call site] 00418
3 mp_to_mont [function] [call site] 00420
3 mpl_get_bits [function] [call site] 00421
3 s_mp_redc [function] [call site] 00423
3 s_mp_redc [function] [call site] 00425
3 s_mp_mul_mont [function] [call site] 00426
3 abort [call site] 00427
3 s_mp_redc [function] [call site] 00428
3 s_mp_redc [function] [call site] 00430
3 s_mp_redc [function] [call site] 00432
3 s_mp_redc [function] [call site] 00433
3 s_mp_redc [function] [call site] 00435
3 s_mp_redc [function] [call site] 00437
3 s_mp_redc [function] [call site] 00439
3 s_mp_redc [function] [call site] 00441
3 s_mp_mul_mont [function] [call site] 00442
3 s_mp_redc [function] [call site] 00444
3 s_mp_redc [function] [call site] 00446
3 s_mp_redc [function] [call site] 00448
3 s_mp_mul_mont [function] [call site] 00449
3 s_mp_redc [function] [call site] 00451
3 s_mp_redc [function] [call site] 00453
3 s_mp_redc [function] [call site] 00455
3 s_mp_mul_mont [function] [call site] 00456
3 s_mp_redc [function] [call site] 00458
3 s_mp_redc [function] [call site] 00460
3 s_mp_redc [function] [call site] 00462
3 s_mp_mul_mont [function] [call site] 00463
3 s_mp_redc [function] [call site] 00465
3 s_mp_redc [function] [call site] 00467
3 s_mp_redc [function] [call site] 00469
3 abort [call site] 00470
3 s_mp_redc [function] [call site] 00472
3 s_mp_redc [function] [call site] 00474
3 s_mp_redc [function] [call site] 00476
3 s_mp_redc [function] [call site] 00478
3 s_mp_redc [function] [call site] 00480
3 s_mp_redc [function] [call site] 00482
3 s_mp_redc [function] [call site] 00484
3 s_mp_redc [function] [call site] 00486
3 s_mp_redc [function] [call site] 00488
3 s_mp_redc [function] [call site] 00490
3 s_mp_mul_mont [function] [call site] 00491
3 s_mp_redc [function] [call site] 00493
3 s_mp_redc [function] [call site] 00495
3 s_mp_redc [function] [call site] 00496
3 s_mp_redc [function] [call site] 00498
3 s_mp_mul_mont [function] [call site] 00499
3 s_mp_redc [function] [call site] 00501
3 s_mp_redc [function] [call site] 00503
3 s_mp_redc [function] [call site] 00505
3 s_mp_redc [function] [call site] 00506
3 s_mp_mul_mont [function] [call site] 00507
3 s_mp_redc [function] [call site] 00509
3 s_mp_redc [function] [call site] 00510
3 s_mp_redc [function] [call site] 00512
3 s_mp_redc [function] [call site] 00514
3 s_mp_mul_mont [function] [call site] 00515
3 s_mp_redc [function] [call site] 00517
3 s_mp_redc [function] [call site] 00519
3 s_mp_redc [function] [call site] 00521
3 s_mp_redc [function] [call site] 00522
3 s_mp_mul_mont [function] [call site] 00523
3 s_mp_redc [function] [call site] 00525
3 s_mp_redc [function] [call site] 00526
3 s_mp_redc [function] [call site] 00528
3 s_mp_redc [function] [call site] 00529
3 abort [call site] 00530
3 s_mp_redc [function] [call site] 00532
3 s_mp_redc [function] [call site] 00534
3 s_mp_redc [function] [call site] 00535
3 s_mp_redc [function] [call site] 00537
3 s_mp_redc [function] [call site] 00538
3 s_mp_redc [function] [call site] 00540
3 s_mp_redc [function] [call site] 00542
3 s_mp_redc [function] [call site] 00544
3 s_mp_redc [function] [call site] 00546
3 s_mp_redc [function] [call site] 00548
3 s_mp_redc [function] [call site] 00550
3 s_mp_redc [function] [call site] 00552
3 s_mp_mul_mont [function] [call site] 00553
3 s_mp_redc [function] [call site] 00555
3 s_mp_redc [function] [call site] 00557
3 s_mp_redc [function] [call site] 00559
3 s_mp_redc [function] [call site] 00561
3 s_mp_redc [function] [call site] 00563
3 s_mp_mul_mont [function] [call site] 00564
3 s_mp_redc [function] [call site] 00566
3 s_mp_redc [function] [call site] 00568
3 s_mp_redc [function] [call site] 00570
3 s_mp_redc [function] [call site] 00572
3 s_mp_redc [function] [call site] 00574
3 s_mp_mul_mont [function] [call site] 00575
3 s_mp_redc [function] [call site] 00577
3 s_mp_redc [function] [call site] 00579
3 s_mp_redc [function] [call site] 00581
3 s_mp_redc [function] [call site] 00583
3 s_mp_redc [function] [call site] 00585
3 s_mp_mul_mont [function] [call site] 00586
3 s_mp_redc [function] [call site] 00588
3 s_mp_redc [function] [call site] 00590
3 s_mp_redc [function] [call site] 00592
3 s_mp_redc [function] [call site] 00594
3 s_mp_redc [function] [call site] 00596
3 s_mp_mul_mont [function] [call site] 00597
3 s_mp_redc [function] [call site] 00599
3 s_mp_redc [function] [call site] 00601
3 s_mp_redc [function] [call site] 00603
3 s_mp_redc [function] [call site] 00605
3 s_mp_redc [function] [call site] 00607
3 s_mp_mul_mont [function] [call site] 00608
3 s_mp_redc [function] [call site] 00610
3 s_mp_redc [function] [call site] 00612
3 s_mp_redc [function] [call site] 00614
3 s_mp_redc [function] [call site] 00616
3 s_mp_redc [function] [call site] 00618
3 abort [call site] 00619
3 abort [call site] 00620
3 s_mp_redc [function] [call site] 00621
1 __assert_fail [call site] 00629
1 BN_mod_exp [call site] 00630
1 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00631
1 BN_CTX_end [call site] 00633