Fuzz introspector: /src/nss/out/Debug/../../fuzz/mpi_sqrmod_target.cc
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
20580 92835 20 :

['SECITEM_CopyItem_Util', 'PORT_SetError_Util', 'CERT_DestroyCertificate', 'ssl_MapLowLevelError', 'ssl3_BeginHandleCertificateRequest', 'ssl3_HandleExtensions', 'tls13_IsPostHandshake', 'tls13_SendPostHandshakeCertificate', 'ssl_Trace', 'SECITEM_FreeItem_Util', 'CERT_DestroyCertificateList', 'SECKEY_DestroyPrivateKey', 'getpid', 'tls13_SetHsState', 'ssl_HashPostHandshakeMessage', 'tls13_FatalError', 'PR_Assert', 'PORT_Free_Util', 'PK11_CloneContext', 'ssl3_ConsumeHandshakeVariable']

20580 92835 tls13_HandleCertificateRequest call site: 00000 /src/nss/out/Debug/../../lib/ssl/tls13con.c:3022
16674 123218 24 :

['SECKEY_ExtractPublicKey', 'PORT_SetError_Util', 'ssl_SignatureSchemeToAuthType', 'ssl_ConsumeSignatureScheme', 'ssl_MapLowLevelError', 'ssl3_BeginHandleCertificateRequest', 'ssl_SetAuthKeyBits', 'tls13_IsVerifyingWithDelegatedCredential', 'PORT_GetError_Util', 'ssl_VerifySignedHashesWithPubKey', 'ssl_CheckSignatureSchemeConsistency', 'ssl_SignatureSchemeToHashType', 'getpid', 'tls13_SetHsState', 'ssl_HashPostHandshakeMessage', 'tls13_ComputeHandshakeHashes', 'tls13_FatalError', 'SECKEY_DestroyPublicKey', 'tls13_AddContextToHashes', 'PR_Assert', 'ssl_HashHandshakeMessage', 'ssl_Trace', 'ssl3_ConsumeHandshakeVariable', 'tls13_VerifyDelegatedCredential']

16674 123218 tls13_HandleCertificateVerify call site: 00000 /src/nss/out/Debug/../../lib/ssl/tls13con.c:5142
16664 16664 1 :

['sftk_CreateNewSlot']

16664 17628 NSC_CreateObject call site: 00000 /src/nss/out/Debug/../../lib/softoken/pkcs11.c:4842
16543 36030 18 :

['PR_WaitCondVar', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssToken_Remove', 'nssToken_Destroy', 'PK11_InitToken', 'nssToken_GetDefaultSession', 'PR_Unlock', 'nssToken_NotifyCertsNotVisible', 'PK11Slot_GetNSSToken', 'PR_Lock', 'nssTrustDomain_UpdateCachedTokenCerts', 'nssSession_EnterMonitor', 'nssSession_ExitMonitor', 'PK11_GetSlotInfo', 'PR_IntervalNow', 'token_status_checked', 'nssToken_Refresh']

16543 36030 nssSlot_IsTokenPresent call site: 00000 /src/nss/out/Debug/../../lib/dev/devslot.c:130
14748 88475 20 :

['ssl3_CleanupPeerCerts', 'SECITEM_CopyItem_Util', 'PORT_SetError_Util', 'ssl_Time', 'dtls_ReceivedFirstMessageInFlight', 'SECITEM_CompareItem_Util', 'ssl_CipherSpecReleaseByEpoch', 'ssl3_HandleNoCertificate', 'SECKEY_UpdateCertPQG', 'getpid', 'tls13_SetHsState', 'ssl_HashPostHandshakeMessage', 'tls13_FatalError', 'PORT_NewArena_Util', 'PR_Assert', 'tls13_HandleCertificateEntry', 'ssl_Trace', 'ssl3_ConsumeHandshakeVariable', 'ssl3_AuthCertificate', 'PORT_ArenaAlloc_Util']

14748 88475 tls13_HandleCertificate call site: 00000 /src/nss/out/Debug/../../lib/ssl/tls13con.c:4058
13440 49820 18 :

['SECKEY_GetPublicKeyType', 'PK11_PubDeriveWithKDF', 'SECKEY_CreateECPrivateKey', 'PK11_FreeSymKey', 'SECKEY_PublicKeyStrengthInBits', 'PORT_SetError_Util', 'PK11_WrapSymKey', 'PK11_KeyGen', 'ssl_MapLowLevelError', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'PK11_GetBestKeyLength', 'SECKEY_DestroyPrivateKey', 'PK11_PubWrapSymKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_DestroyPublicKey', 'ssl_SetWrappingKey', 'PR_Assert']

13440 50754 ssl3_GetWrappingKey call site: 00000 /src/nss/out/Debug/../../lib/ssl/ssl3con.c:6049
11713 11713 2 :

['tls13_WriteServerEchSignal', 'tls13_WriteServerEchHrrSignal']

11713 11713 ssl_ConstructServerHello call site: 00000 /src/nss/out/Debug/../../lib/ssl/ssl3con.c:10011
11366 15619 7 :

['tls13_ComputeEarlySecretsWithPsk', 'CERT_DupCertificate', 'tls13_RecoverWrappedSharedSecret', 'ssl_FindServerCert', 'tls13_RestoreCipherInfo', 'SECITEM_CompareItem_Util', 'ssl3_RegisterExtensionSender']

34068 135314 tls13_HandleClientHelloPart2 call site: 00000 /src/nss/out/Debug/../../lib/ssl/tls13con.c:2253
11250 120798 25 :

['PK11_FreeSymKey', 'ssl_UncacheSessionID', 'SECITEM_CopyItem_Util', 'ssl3_ConsumeHandshakeNumber', 'ssl_Time', 'CERT_DupCertificate', 'PORT_SetError_Util', 'ssl_FreeSID', 'ssl_PrintBuf', 'tls13_HkdfExpandLabel', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_GetHash', 'ssl3_ConsumeHandshake', 'tls13_GetHashSize', 'ssl3_NewSessionID', 'getpid', 'ssl3_SetSIDSessionTicket', 'tls13_FatalError', 'PR_ntohl', 'PR_Assert', 'ssl3_FillInCachedSID', 'ssl_CacheSessionID', 'ssl_Trace', 'ssl3_ConsumeHandshakeVariable']

11250 120798 tls13_HandleNewSessionTicket call site: 00000 /src/nss/out/Debug/../../lib/ssl/tls13con.c:6149
10815 25482 10 :

['SECITEM_FreeItem_Util', 'PK11_ConcatSymKeys', 'PK11_FreeSymKey', 'getpid', 'tls13_HandleKEMKey', 'PORT_SetError_Util', 'tls13_FatalError', 'PR_Assert', 'PORT_GetError_Util', 'ssl_Trace']

10815 25482 tls13_HandleClientKeyShare call site: 00000 /src/nss/out/Debug/../../lib/ssl/tls13con.c:2663
9446 9446 3 :

['VFY_Update', 'VFY_End', 'VFY_Begin']

9446 9446 vfy_SingleShot call site: 00000 /src/nss/out/Debug/../../lib/cryptohi/secvfy.c:955
8356 18110 8 :

['ssl_TicketTimeValid', 'ssl_UncacheSessionID', 'ssl3_SetupCipherSuite', 'ssl_FreeSID', 'tls13_RecoverWrappedSharedSecret', 'PR_Assert', 'PORT_GetError_Util', 'SSL_AtomicIncrementLong']

16930 46400 tls13_SetupClientHello call site: 00000 /src/nss/out/Debug/../../lib/ssl/tls13con.c:572

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 BN_CTX_new [call site] 00001
1 mp_init [function] [call site] 00002
2 mp_init_size [function] [call site] 00003
3 __assert_fail [call site] 00004
3 s_mp_alloc [function] [call site] 00005
4 calloc [call site] 00006
1 parse_input(unsigned char const*, unsigned long, bignum_st*, mp_int*) [function] [call site] 00007
2 to_char(unsigned char const*) [function] [call site] 00008
2 mp_read_raw [function] [call site] 00009
3 __assert_fail [call site] 00010
3 mp_zero [function] [call site] 00011
4 s_mp_setz [function] [call site] 00012
3 mp_mul_d [function] [call site] 00013
4 __assert_fail [call site] 00014
4 mp_zero [function] [call site] 00015
4 mp_copy [function] [call site] 00016
5 __assert_fail [call site] 00017
5 s_mp_setz [function] [call site] 00018
5 s_mp_copy [function] [call site] 00019
5 s_mp_alloc [function] [call site] 00020
5 s_mp_copy [function] [call site] 00021
5 s_mp_setz [function] [call site] 00022
5 s_mp_free [function] [call site] 00023
4 s_mp_mul_d [function] [call site] 00024
5 mp_zero [function] [call site] 00025
5 s_mp_ispow2d [function] [call site] 00026
5 s_mp_mul_2d [function] [call site] 00027
6 __assert_fail [call site] 00028
6 s_mp_pad [function] [call site] 00029
7 __assert_fail [call site] 00030
7 s_mp_grow [function] [call site] 00031
8 __assert_fail [call site] 00032
8 s_mp_alloc [function] [call site] 00033
8 s_mp_copy [function] [call site] 00034
8 s_mp_setz [function] [call site] 00035
8 s_mp_free [function] [call site] 00036
7 s_mp_setz [function] [call site] 00037
6 s_mp_lshd [function] [call site] 00038
7 __assert_fail [call site] 00039
7 s_mp_pad [function] [call site] 00040
6 s_mp_clamp [function] [call site] 00041
5 s_mp_pad [function] [call site] 00042
5 s_mpv_mul_set_vec64 [call site] 00043
5 s_mp_clamp [function] [call site] 00044
3 mp_add_d [function] [call site] 00045
4 __assert_fail [call site] 00046
4 mp_init_copy [function] [call site] 00047
5 __assert_fail [call site] 00048
5 s_mp_alloc [function] [call site] 00049
5 s_mp_copy [function] [call site] 00050
4 s_mp_add_d [function] [call site] 00051
5 s_mp_pad [function] [call site] 00052
4 s_mp_cmp_d [function] [call site] 00053
5 __assert_fail [call site] 00054
4 s_mp_sub_d [function] [call site] 00055
5 s_mp_clamp [function] [call site] 00056
4 mp_neg [function] [call site] 00057
5 __assert_fail [call site] 00058
5 mp_copy [function] [call site] 00059
5 s_mp_cmp_d [function] [call site] 00060
4 s_mp_cmp_d [function] [call site] 00061
4 s_mp_exch [function] [call site] 00062
4 mp_clear [function] [call site] 00063
5 s_mp_setz [function] [call site] 00064
5 s_mp_free [function] [call site] 00065
2 __assert_fail [call site] 00066
2 BN_bin2bn [call site] 00067
2 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00068
3 BN_bn2hex [call site] 00069
3 mp_toradix [function] [call site] 00070
4 __assert_fail [call site] 00071
4 __assert_fail [call site] 00072
4 mp_cmp_z [function] [call site] 00073
5 __assert_fail [call site] 00074
4 mp_init_copy [function] [call site] 00075
4 mp_cmp_z [function] [call site] 00076
4 mp_div_d [function] [call site] 00077
5 __assert_fail [call site] 00078
5 s_mp_ispow2d [function] [call site] 00079
5 mp_copy [function] [call site] 00080
5 s_mp_div_2d [function] [call site] 00081
6 s_mp_rshd [function] [call site] 00082
7 s_mp_setz [function] [call site] 00083
6 s_mp_clamp [function] [call site] 00084
5 mp_init_copy [function] [call site] 00085
5 s_mp_div_d [function] [call site] 00086
6 mp_init_size [function] [call site] 00087
6 mp_init_copy [function] [call site] 00088
6 s_mp_norm [function] [call site] 00089
7 __assert_fail [call site] 00090
7 s_mp_mul_2d [function] [call site] 00091
7 s_mp_mul_2d [function] [call site] 00092
6 s_mpv_div_2dx1d [function] [call site] 00093
6 s_mp_lshd [function] [call site] 00094
6 s_mp_clamp [function] [call site] 00095
6 mp_exch [function] [call site] 00096
7 __assert_fail [call site] 00097
7 s_mp_exch [function] [call site] 00098
6 mp_clear [function] [call site] 00099
6 mp_clear [function] [call site] 00100
5 s_mp_cmp_d [function] [call site] 00101
5 s_mp_exch [function] [call site] 00102
5 mp_clear [function] [call site] 00103
4 mp_clear [function] [call site] 00104
4 s_mp_todigit [function] [call site] 00105
5 tolower [call site] 00106
4 mp_clear [function] [call site] 00107
3 CRYPTO_free [call site] 00108
3 __assert_fail [call site] 00109
1 mp_cmp_z [function] [call site] 00110
1 mp_clear [function] [call site] 00111
1 mp_clear [function] [call site] 00112
1 mp_clear [function] [call site] 00113
1 BN_CTX_end [call site] 00114
1 BN_CTX_free [call site] 00115
1 mp_sqrmod [function] [call site] 00116
2 __assert_fail [call site] 00117
2 mp_sqr [function] [call site] 00118
3 __assert_fail [call site] 00119
3 mp_init_copy [function] [call site] 00120
3 s_mp_grow [function] [call site] 00121
3 s_mp_sqr_comba_4 [function] [call site] 00122
3 s_mp_sqr_comba_8 [function] [call site] 00123
3 s_mp_sqr_comba_16 [function] [call site] 00124
3 s_mp_sqr_comba_32 [function] [call site] 00125
3 s_mpv_mul_set_vec64 [call site] 00126
3 s_mpv_mul_add_vec64 [call site] 00127
3 s_mp_mul_2 [function] [call site] 00128
4 __assert_fail [call site] 00129
4 s_mp_grow [function] [call site] 00130
3 s_mpv_sqr_add_prop [function] [call site] 00131
3 s_mp_clamp [function] [call site] 00132
3 mp_clear [function] [call site] 00133
2 mp_mod [function] [call site] 00134
3 __assert_fail [call site] 00135
3 s_mp_cmp [function] [call site] 00136
4 __assert_fail [call site] 00137
3 mp_div [function] [call site] 00138
4 __assert_fail [call site] 00139
4 mp_cmp_z [function] [call site] 00140
4 mp_init_copy [function] [call site] 00141
4 mp_copy [function] [call site] 00142
4 mp_init_size [function] [call site] 00143
4 s_mp_pad [function] [call site] 00144
4 mp_zero [function] [call site] 00145
4 s_mp_cmp [function] [call site] 00146
4 mp_zero [function] [call site] 00147
4 mp_set [function] [call site] 00148
5 mp_zero [function] [call site] 00149
4 mp_zero [function] [call site] 00150
4 mp_init_copy [function] [call site] 00151
4 s_mp_div [function] [call site] 00152
5 mp_cmp_z [function] [call site] 00153
5 s_mp_ispow2 [function] [call site] 00154
6 __assert_fail [call site] 00155
6 s_mp_ispow2d [function] [call site] 00156
5 mp_copy [function] [call site] 00157
5 s_mp_div_2d [function] [call site] 00158
5 s_mp_mod_2d [function] [call site] 00159
6 s_mp_clamp [function] [call site] 00160
5 mp_init_size [function] [call site] 00161
5 s_mp_norm [function] [call site] 00162
5 s_mp_cmp [function] [call site] 00163
5 s_mp_cmp [function] [call site] 00164
5 __assert_fail [call site] 00165
5 s_mpv_div_2dx1d [function] [call site] 00166
5 __assert_fail [call site] 00167
5 mp_copy [function] [call site] 00168
5 s_mp_mul_d [function] [call site] 00169
5 s_mp_cmp [function] [call site] 00170
5 s_mp_sub [function] [call site] 00171
6 s_mp_clamp [function] [call site] 00172
5 s_mp_sub [function] [call site] 00173
5 s_mp_clamp [function] [call site] 00174
5 s_mp_div_2d [function] [call site] 00175
5 s_mp_clamp [function] [call site] 00176
5 mp_clear [function] [call site] 00177
4 s_mp_cmp_d [function] [call site] 00178
4 s_mp_cmp_d [function] [call site] 00179
4 s_mp_exch [function] [call site] 00180
4 s_mp_exch [function] [call site] 00181
4 mp_clear [function] [call site] 00182
4 mp_clear [function] [call site] 00183
4 mp_clear [function] [call site] 00184
3 mp_add [function] [call site] 00185
4 __assert_fail [call site] 00186
4 s_mp_add_3arg [function] [call site] 00187
5 s_mp_pad [function] [call site] 00188
5 s_mp_pad [function] [call site] 00189
4 s_mp_cmp [function] [call site] 00190
4 s_mp_sub_3arg [function] [call site] 00191
5 s_mp_pad [function] [call site] 00192
5 s_mp_clamp [function] [call site] 00193
4 s_mp_sub_3arg [function] [call site] 00194
4 s_mp_cmp_d [function] [call site] 00195
3 mp_copy [function] [call site] 00196
3 mp_cmp_z [function] [call site] 00197
3 mp_add [function] [call site] 00198
3 mp_zero [function] [call site] 00199
1 __assert_fail [call site] 00200
1 BN_mod_sqr [call site] 00201
1 check_equal(bignum_st*, mp_int*, unsigned long) [function] [call site] 00202
1 mp_clear [function] [call site] 00203
1 BN_CTX_end [call site] 00204