High level conclusions

Fuzzers reach 34.22% of cyclomatic complexity.

Fuzzers reach 28.12% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

2682 / 9536

Cyclomatic complexity statically reachable by fuzzers

23076 / 67430

Runtime code coverage of functions

3454 / 9536

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: certDN

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	449	44.4%
gold	[1:9]	214	21.1%
yellow	[10:29]	20	1.97%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	328	32.4%
All colors	1011	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5532	7376	3 : View List ['PR_Lock', 'PR_Assert', 'PR_Unlock']	5532	10142	_PR_Getfd	call site: 00305	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c:59
1844	4610	3 : View List ['PR_Free', 'PR_Malloc', 'PR_Assert']	1844	4610	BuildArgArray	call site: 00033	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c:428
1133	1133	1 : View List ['DecodeGroup']	1133	2981	DecodeItem	call site: 00816	/src/nss/out/Debug/../../lib/util/quickder.c:715
1133	1133	1 : View List ['DecodeInline']	1133	2057	DecodeItem	call site: 00815	/src/nss/out/Debug/../../lib/util/quickder.c:690
1133	1133	1 : View List ['DecodeExplicit']	1133	2057	DecodeItem	call site: 00816	/src/nss/out/Debug/../../lib/util/quickder.c:695
1133	1133	1 : View List ['DecodePointer']	1133	2057	DecodeItem	call site: 00816	/src/nss/out/Debug/../../lib/util/quickder.c:703
1133	1133	1 : View List ['DecodeChoice']	1133	2057	DecodeItem	call site: 00816	/src/nss/out/Debug/../../lib/util/quickder.c:705
1133	1133	1 : View List ['DecodeSequence']	1133	2057	DecodeItem	call site: 00816	/src/nss/out/Debug/../../lib/util/quickder.c:724
978	978	1 : View List ['secoid_FindDynamicByTag']	978	978	SECOID_FindOIDByTag_Util	call site: 00675	/src/nss/out/Debug/../../lib/util/secoid.c:2314
978	978	1 : View List ['secoid_FindDynamicByTag']	978	978	secoid_FindXOidByTag	call site: 00592	/src/nss/out/Debug/../../lib/util/secoid.c:2367
960	1889	2 : View List ['SECITEM_FreeItem_Util', 'PORT_ArenaRelease_Util']	960	1889	SECITEM_AllocItem_Util	call site: 00695	/src/nss/out/Debug/../../lib/util/secitem.c:45
955	955	1 : View List ['handleHashAlgSupport']	6487	14051	SECOID_Init	call site: 00476	/src/nss/out/Debug/../../lib/util/secoid.c:2201

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

119

Reachable functions

312

Percentage of reachable functions covered

61.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/certDN.cc	1
/src/nss/out/Debug/../../lib/util/secoid.c	12
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	3
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	4
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	4
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	4
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	3
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	4
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/util/secport.c	23
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/util/nssrwlk.c	4
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	8
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	8
/src/nss/out/Debug/../../lib/util/secitem.c	9
/src/nss/out/Debug/../../lib/certdb/alg1485.c	29
/src/nss/out/Debug/../../lib/certdb/secname.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/util/oidstring.c	1
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nss/out/Debug/../../lib/util/dersubr.c	2
/src/nss/out/Debug/../../lib/certhigh/certhtml.c	1
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	1

Fuzzer: pkcs7

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2773	52.5%
gold	[1:9]	843	15.9%
yellow	[10:29]	74	1.40%
greenyellow	[30:49]	46	0.87%
lawngreen	50+	1537	29.1%
All colors	5273	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17500	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	17500	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065
5532	7376	3 : View List ['PR_Lock', 'PR_Assert', 'PR_Unlock']	5532	10142	_PR_Getfd	call site: 00308	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c:59
5330	6295	7 : View List ['sftk_checkNeedLogin', 'sftkdb_GetUpdateID', 'sftk_freeDB', 'sftk_isBlank', 'sftkdb_HasPasswordSet', 'sftkdb_NeedUpdateDBPassword', 'sftk_setStringName']	5330	6295	NSC_GetTokenInfo	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:3925
5313	5313	2 : View List ['sftkdb_HasPasswordSet', 'sftk_hasNullPassword']	5313	5313	SFTK_SlotReInit	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:2902
5307	6484	3 : View List ['secmod_handleReload', 'secmod_FindModuleByFuncPtr', 'SECMOD_DestroyModule']	5307	9394	secmod_ModuleInit	call site: 00620	/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c:246
5306	8083	4 : View List ['nss_MkConfigString', 'PORT_ZAlloc_Util', 'SECMOD_RestartModules', 'PORT_SetError_Util']	14955	37879	nss_Init	call site: 00584	/src/nss/out/Debug/../../lib/nss/nssinit.c:632
4122	4122	1 : View List ['PK11_CreateContextByPubKey']	4122	4122	VFY_Begin	call site: 04714	/src/nss/out/Debug/../../lib/cryptohi/secvfy.c:919
3818	3818	1 : View List ['pk11_MakeIDFromPublicKey']	5662	14527	PK11_ImportPublicKey	call site: 04476	/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c:112
3807	12003	7 : View List ['nssToken_Destroy', 'PK11_GetSlotInfo', 'PK11_EnterSlotMonitor', 'nssToken_IsPresent', 'PK11_ExitSlotMonitor', 'PK11_InitToken', 'PK11Slot_GetNSSToken']	3807	12003	pk11_IsPresentCertLoad	call site: 00871	/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c:1624
3807	3807	1 : View List ['nssTrust_Create']	3807	6130	nssTrustDomain_FindTrustForCertificate	call site: 01903	/src/nss/out/Debug/../../lib/pki/trustdomain.c:1086

Runtime coverage analysis

Covered functions

1275

Functions that are reachable but not covered

435

Reachable functions

1219

Percentage of reachable functions covered

64.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/pkcs7.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	8
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	3
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	12
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	7
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	40
/src/nss/out/Debug/../../lib/certdb/crl.c	42
/src/nss/out/Debug/../../lib/util/secport.c	27
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	64
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	8
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	19
/src/nss/out/Debug/../../lib/dev/devtoken.c	17
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	27
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	6
/src/nss/out/Debug/../../lib/util/secoid.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	16
/src/nss/out/Debug/../../lib/certdb/secname.c	13
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	7
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	29
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	16
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	2
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	8
/src/nss/out/Debug/../../lib/dev/ckhelper.c	5
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	13
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	2
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	2
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/pkcs7/certread.c	6
/src/nss/out/Debug/../../lib/util/secasn1d.c	42
/src/nss/out/Debug/../../lib/util/nssb64d.c	14
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	14
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	24
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/certhigh/certvfypkix.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	19
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	3
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/util/secdig.c	2
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	3
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11nobj.c	1
/src/nss/out/Debug/../../lib/certhigh/crlv2.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	3
/src/nss/out/Debug/../../lib/util/portreg.c	8

Fuzzer: smime

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3785	69.5%
gold	[1:9]	922	16.9%
yellow	[10:29]	103	1.89%
greenyellow	[30:49]	38	0.69%
lawngreen	50+	596	10.9%
All colors	5444	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17500	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	17500	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	15842	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 03712	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	13920	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 05291	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11086	11086	5 : View List ['sftk_FindAttribute', 'PR_Assert', 'sftk_isTrue', 'sftk_ObjectFromHandle', 'sftk_FreeAttribute']	14934	15865	sftk_InitGeneric	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:494
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 03597	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
7315	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7315	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065
5532	7376	3 : View List ['PR_Lock', 'PR_Assert', 'PR_Unlock']	5532	10142	_PR_Getfd	call site: 00308	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c:59
5330	6295	7 : View List ['sftk_checkNeedLogin', 'sftkdb_GetUpdateID', 'sftk_freeDB', 'sftk_isBlank', 'sftkdb_HasPasswordSet', 'sftkdb_NeedUpdateDBPassword', 'sftk_setStringName']	5330	6295	NSC_GetTokenInfo	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:3925
5313	5313	2 : View List ['sftkdb_HasPasswordSet', 'sftk_hasNullPassword']	5313	5313	SFTK_SlotReInit	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:2902
5307	6484	3 : View List ['secmod_handleReload', 'secmod_FindModuleByFuncPtr', 'SECMOD_DestroyModule']	5445	9394	secmod_ModuleInit	call site: 00620	/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c:246
5306	8083	4 : View List ['nss_MkConfigString', 'PORT_ZAlloc_Util', 'SECMOD_RestartModules', 'PORT_SetError_Util']	14955	37879	nss_Init	call site: 00584	/src/nss/out/Debug/../../lib/nss/nssinit.c:632
3807	12003	7 : View List ['nssToken_Destroy', 'PK11_GetSlotInfo', 'PK11_EnterSlotMonitor', 'nssToken_IsPresent', 'PK11_ExitSlotMonitor', 'PK11_InitToken', 'PK11Slot_GetNSSToken']	3807	12003	pk11_IsPresentCertLoad	call site: 00871	/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c:1624

Runtime coverage analysis

Covered functions

780

Functions that are reachable but not covered

738

Reachable functions

1241

Percentage of reachable functions covered

40.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/smime.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	36
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	66
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	40
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	21
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	23
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	6
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	27
/src/nss/out/Debug/../../lib/dev/devutil.c	26
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	14
/src/nss/out/Debug/../../lib/pki/certificate.c	13
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	16
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	13
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	10
/src/nss/out/Debug/../../lib/dev/ckhelper.c	6
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	3
/src/nss/out/Debug/../../lib/pki/pkistore.c	11
/src/nss/out/Debug/../../lib/pki/trustdomain.c	11
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	2
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	1
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	2
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/smime/cmsdecode.c	12
/src/nss/out/Debug/../../lib/smime/cmsmessage.c	4
/src/nss/out/Debug/../../lib/smime/cmscinfo.c	8
/src/nss/out/Debug/../../lib/smime/cmsenvdata.c	4
/src/nss/out/Debug/../../lib/smime/cmsrecinfo.c	3
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	18
/src/nss/out/Debug/../../lib/smime/cmssigdata.c	4
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	1
/src/nss/out/Debug/../../lib/smime/cmssiginfo.c	1
/src/nss/out/Debug/../../lib/smime/cmsencdata.c	4
/src/nss/out/Debug/../../lib/smime/cmsdigdata.c	4
/src/nss/out/Debug/../../lib/smime/cmsudf.c	9
/src/nss/out/Debug/../../lib/smime/cmsdigest.c	6
/src/nss/out/Debug/../../lib/smime/cmscipher.c	4
/src/nss/out/Debug/../../lib/util/secasn1d.c	44
/src/nss/out/Debug/../../lib/smime/cmsutil.c	5
/src/nss/out/Debug/../../lib/smime/cmsarray.c	2
/src/nss/out/Debug/../../lib/smime/smimeutil.c	17
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/smime/cmsreclist.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	23
/src/nss/out/Debug/../../lib/pk11wrap/pk11nobj.c	2
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	13
/src/nss/out/Debug/../../lib/smime/cmspubkey.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11pbe.c	17

Fuzzer: pkcs12

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5360	75.9%
gold	[1:9]	927	13.1%
yellow	[10:29]	92	1.30%
greenyellow	[30:49]	29	0.41%
lawngreen	50+	651	9.22%
All colors	7059	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 03541	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 04851	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8564	10549	4 : View List ['PK11_FreeSlot', 'PORT_SetError_Util', 'pk11_CopyToSlot', 'PK11_GetBestSlotMultiple']	8564	10549	pk11_ForceSlotMultiple	call site: 04473	/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c:957
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065
6935	6935	2 : View List ['sec_pkcs7_decoder_get_recipient_key', 'PK11_GetKeyStrength']	6935	17689	sec_pkcs7_decoder_start_decrypt	call site: 03885	/src/nss/out/Debug/../../lib/pkcs7/p7decode.c:486
5532	7376	3 : View List ['PR_Lock', 'PR_Assert', 'PR_Unlock']	5532	10142	_PR_Getfd	call site: 00308	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c:59
5330	6295	7 : View List ['sftk_checkNeedLogin', 'sftkdb_GetUpdateID', 'sftk_freeDB', 'sftk_isBlank', 'sftkdb_HasPasswordSet', 'sftkdb_NeedUpdateDBPassword', 'sftk_setStringName']	5330	6295	NSC_GetTokenInfo	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:3925
5313	5313	2 : View List ['sftkdb_HasPasswordSet', 'sftk_hasNullPassword']	5313	5313	SFTK_SlotReInit	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:2902
5307	6484	3 : View List ['secmod_handleReload', 'secmod_FindModuleByFuncPtr', 'SECMOD_DestroyModule']	5307	9394	secmod_ModuleInit	call site: 00620	/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c:246
5306	8083	4 : View List ['nss_MkConfigString', 'PORT_ZAlloc_Util', 'SECMOD_RestartModules', 'PORT_SetError_Util']	14955	37879	nss_Init	call site: 00584	/src/nss/out/Debug/../../lib/nss/nssinit.c:632
4820	4820	2 : View List ['PK11_Authenticate', 'PK11_GetRWSession']	5756	10767	PK11_KeyGenWithTemplate	call site: 04413	/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c:1207
3815	5672	3 : View List ['PK11_GenerateRandom', 'PORT_Alloc_Util', 'PK11_EnterContextMonitor']	6758	13317	PK11_CipherOp	call site: 00000	/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c:881

Runtime coverage analysis

Covered functions

858

Functions that are reachable but not covered

971

Reachable functions

1490

Percentage of reachable functions covered

34.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/pkcs12.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	8
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	45
/src/nss/out/Debug/../../lib/certdb/crl.c	42
/src/nss/out/Debug/../../lib/util/secport.c	28
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	69
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	8
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	24
/src/nss/out/Debug/../../lib/dev/devtoken.c	26
/src/nss/out/Debug/../../lib/dev/devslot.c	10
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	12
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	28
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	30
/src/nss/out/Debug/../../lib/dev/devutil.c	29
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	26
/src/nss/out/Debug/../../lib/pki/pki3hack.c	24
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	6
/src/nss/out/Debug/../../lib/util/secoid.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	20
/src/nss/out/Debug/../../lib/certdb/secname.c	13
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	7
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	29
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	17
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	14
/src/nss/out/Debug/../../lib/base/utf8.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	10
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	11
/src/nss/out/Debug/../../lib/pki/pkistore.c	25
/src/nss/out/Debug/../../lib/pki/trustdomain.c	16
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	3
/src/nss/out/Debug/../../lib/util/nsshash.c	3
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	2
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	13
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/pkcs12/p12d.c	49
/src/nss/out/Debug/../../lib/util/secasn1d.c	47
/src/nss/out/Debug/../../lib/pkcs7/p7decode.c	16
/src/nss/out/Debug/../../lib/pkcs7/p7local.c	8
/src/nss/out/Debug/../../lib/pkcs7/p7common.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	25
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	18
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	27
/src/nss/out/Debug/../../lib/pk11wrap/pk11pbe.c	23
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pkcs12/p12local.c	6
/src/nss/out/Debug/../../lib/pkcs12/p12plcy.c	3
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	1
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	15
/src/nss/out/Debug/../../lib/util/pkcs11uri.c	18
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3
/src/nss/out/Debug/../../lib/certhigh/certvfypkix.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	25
/src/nss/out/Debug/../../lib/util/secdig.c	2
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	3
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11nobj.c	4
/src/nss/out/Debug/../../lib/certhigh/crlv2.c	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7

Fuzzer: tls-server-no_fuzzer_mode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7464	59.6%
gold	[1:9]	1428	11.4%
yellow	[10:29]	254	2.02%
greenyellow	[30:49]	79	0.63%
lawngreen	50+	3292	26.3%
All colors	12517	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
40513	56350	18 : View List ['NSS_SecureMemcmp', 'ssl3_SendChangeCipherSpecs', 'PR_GetCurrentThread', 'ssl3_ComputeHandshakeHashes', 'ssl3_ExtensionNegotiated', 'ssl3_KEASupportsTickets', 'ssl3_SendFinished', 'dtls_ReceivedFirstMessageInFlight', 'ssl3_FinishHandshake', 'PR_Assert', 'ssl3_ComputeTLSFinished', 'ssl_HashHandshakeMessage', 'ssl3_SendNextProto', 'ssl3_SendNewSessionTicket', 'ssl3_IllegalParameter', 'PR_EnterMonitor', 'ssl3_HandshakeFailure', 'PR_ExitMonitor']	40513	75506	ssl3_HandleFinished	call site: 11432	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12326
29369	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	29369	126359	tls13_HandleCertificateVerify	call site: 11959	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
27485	50334	19 : View List ['tls13_FinishHandshake', 'getpid', 'tls13_SetHsState', 'tls13_ComputeFinalSecrets', 'PK11_DestroyContext', 'ssl3_FlushHandshake', 'tls13_SendKeyUpdate', 'dtls_StartTimer', 'ssl_Trace', 'ssl_CipherSpecReleaseByEpoch', 'dtls_ReceivedFirstMessageInFlight', 'PR_Assert', 'tls13_FatalError', 'PORT_SetError_Util', 'tls13_ShouldRequestClientAuth', 'tls13_SendNewSessionTicket', 'tls13_SetCipherSpec', 'PR_EnterMonitor', 'PR_ExitMonitor']	27485	50334	tls13_ServerHandleFinished	call site: 12210	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5758
27354	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	27354	95509	tls13_HandleCertificateRequest	call site: 11871	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
21012	123931	25 : View List ['ssl3_ConsumeHandshake', 'CERT_DupCertificate', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'getpid', 'tls13_GetHash', 'ssl_CacheSessionID', 'PR_ntohl', 'ssl3_FillInCachedSID', 'PK11_FreeSymKey', 'ssl3_SetSIDSessionTicket', 'ssl_Trace', 'ssl3_NewSessionID', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf', 'ssl_FreeSID', 'PR_Assert', 'SECITEM_CopyItem_Util', 'tls13_FatalError', 'PORT_SetError_Util', 'tls13_HkdfExpandLabel', 'ssl_UncacheSessionID', 'tls13_GetHashSize', 'ssl_Time']	21012	123931	tls13_HandleNewSessionTicket	call site: 12143	/src/nss/out/Debug/../../lib/ssl/tls13con.c:6262
18805	51655	13 : View List ['SECITEM_FreeItem_Util', 'tls13_ServerMakeChOuterAAD', 'NSS_SecureMemcmp', 'ssl3_MoveRemoteExtensions', 'tls13_UnencodeChInner', 'tls13_FatalError', 'tls13_GetMatchingEchConfigs', 'PORT_SetError_Util', 'getpid', 'tls13_OpenClientHelloInner', 'ssl3_RegisterExtensionSender', 'ssl_Trace', 'ssl_PrintBuf']	18805	51655	tls13_MaybeAcceptEch	call site: 07955	/src/nss/out/Debug/../../lib/ssl/tls13ech.c:2694
17500	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	17500	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16594	34098	12 : View List ['SECITEM_FreeItem_Util', 'ssl_FindServerCert', 'CERT_DupCertificate', 'SECITEM_CopyItem_Util', 'ssl3_UnwrapMasterSecretServer', 'PR_Assert', 'ssl3_SendServerHello', 'ssl3_SendChangeCipherSpecs', 'ssl3_InitPendingCipherSpecs', 'ssl_LookupNamedGroup', 'ssl3_FreeSniNameArray', 'ssl3_SendFinished']	16594	86297	ssl3_HandleClientHelloPart2	call site: 09695	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:9571
15623	110489	24 : View List ['ssl3_CleanupPeerCerts', 'SECKEY_UpdateCertPQG', 'tls13_HandleCertificateEntry', 'ssl3_ConsumeHandshakeVariable', 'ssl3_AuthCertificate', 'getpid', 'tls13_SetHsState', 'SECITEM_ArenaDupItem_Util', 'ssl_Trace', 'ssl_CipherSpecReleaseByEpoch', 'CERT_NewTempCertificate', 'dtls_ReceivedFirstMessageInFlight', 'PORT_ArenaAlloc_Util', 'PORT_NewArena_Util', 'SECITEM_CopyItem_Util', 'ssl3_SendAlertForCertError', 'PR_Assert', 'tls13_FatalError', 'SECITEM_CompareItem_Util', 'ssl3_HandleNoCertificate', 'PORT_SetError_Util', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl_Time']	15623	110489	tls13_HandleCertificate	call site: 11717	/src/nss/out/Debug/../../lib/ssl/tls13con.c:4157
12568	14422	4 : View List ['PR_Assert', 'tls13_ComputePskBinderHash', 'tls13_VerifyFinished', 'tls13_GetHash']	21253	86362	tls13_HandleClientHelloPart2	call site: 09125	/src/nss/out/Debug/../../lib/ssl/tls13con.c:2410
11634	15880	7 : View List ['ssl_FindServerCert', 'CERT_DupCertificate', 'SECITEM_CompareItem_Util', 'tls13_RestoreCipherInfo', 'tls13_RecoverWrappedSharedSecret', 'ssl3_RegisterExtensionSender', 'tls13_ComputeEarlySecretsWithPsk']	41206	138969	tls13_HandleClientHelloPart2	call site: 08890	/src/nss/out/Debug/../../lib/ssl/tls13con.c:2348

Runtime coverage analysis

Covered functions

2523

Functions that are reachable but not covered

791

Reachable functions

2193

Percentage of reachable functions covered

63.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_server.cc	4
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	8
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	6
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	15
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	27
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	37
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	24
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	39
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	24
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	225
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prshma.c	1
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/uxshm.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmmap.c	4
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	9
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	4
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	122
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	12
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	33
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	4
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	27
/src/nss/out/Debug/../../lib/ssl/sslcert.c	19
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_certs.cc	2
/src/nss/out/Debug/../../cpputil/cpputil.h	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nss/out/Debug/../../lib/util/secalgid.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	16
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.h	22
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	20
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3

Fuzzer: dtls-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6779	55.4%
gold	[1:9]	1565	12.7%
yellow	[10:29]	248	2.02%
greenyellow	[30:49]	79	0.64%
lawngreen	50+	3565	29.1%
All colors	12236	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
29369	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	29369	126359	tls13_HandleCertificateVerify	call site: 11677	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
27354	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	27354	95509	tls13_HandleCertificateRequest	call site: 11589	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 08678	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
11634	15880	7 : View List ['ssl_FindServerCert', 'CERT_DupCertificate', 'SECITEM_CompareItem_Util', 'tls13_RestoreCipherInfo', 'tls13_RecoverWrappedSharedSecret', 'ssl3_RegisterExtensionSender', 'tls13_ComputeEarlySecretsWithPsk']	35276	138969	tls13_HandleClientHelloPart2	call site: 08623	/src/nss/out/Debug/../../lib/ssl/tls13con.c:2348
9115	10039	2 : View List ['PR_GetError', 'ssl3_HandleServerHello']	9115	16845	ssl3_HandleHandshakeMessage	call site: 07631	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12727
8694	9621	5 : View List ['PR_Assert', 'PR_GetMonitorEntryCount', 'tls13_UpdateTrafficKeys', 'ssl_Trace', 'getpid']	8694	9621	dtls13_maybeProcessKeyUpdateAck	call site: 07425	/src/nss/out/Debug/../../lib/ssl/dtls13con.c:508
8324	8324	1 : View List ['ssl3_HandleHelloRequest']	8324	8324	ssl3_HandlePostHelloHandshakeMessage	call site: 10421	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12779
7510	7510	1 : View List ['ssl3_HandleServerHelloDone']	7510	7510	ssl3_HandlePostHelloHandshakeMessage	call site: 10829	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12823
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

2505

Functions that are reachable but not covered

714

Reachable functions

2163

Percentage of reachable functions covered

66.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_server.cc	4
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	8
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	6
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	15
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	27
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	34
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	20
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	39
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	24
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	214
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prshma.c	1
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/uxshm.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmmap.c	4
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	9
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	4
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	116
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	12
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	33
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	3
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	24
/src/nss/out/Debug/../../lib/ssl/sslcert.c	19
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_certs.cc	2
/src/nss/out/Debug/../../cpputil/cpputil.h	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nss/out/Debug/../../lib/util/secalgid.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	16
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.h	22
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	19
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3

Fuzzer: tls-client-no_fuzzer_mode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7283	60.5%
gold	[1:9]	1059	8.80%
yellow	[10:29]	138	1.14%
greenyellow	[30:49]	79	0.65%
lawngreen	50+	3468	28.8%
All colors	12027	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
27794	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	27794	95509	tls13_HandleCertificateRequest	call site: 11380	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
26992	123931	25 : View List ['ssl3_ConsumeHandshake', 'CERT_DupCertificate', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'getpid', 'tls13_GetHash', 'ssl_CacheSessionID', 'PR_ntohl', 'ssl3_FillInCachedSID', 'PK11_FreeSymKey', 'ssl3_SetSIDSessionTicket', 'ssl_Trace', 'ssl3_NewSessionID', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf', 'ssl_FreeSID', 'PR_Assert', 'SECITEM_CopyItem_Util', 'tls13_FatalError', 'PORT_SetError_Util', 'tls13_HkdfExpandLabel', 'ssl_UncacheSessionID', 'tls13_GetHashSize', 'ssl_Time']	26992	123931	tls13_HandleNewSessionTicket	call site: 11652	/src/nss/out/Debug/../../lib/ssl/tls13con.c:6262
21516	110489	24 : View List ['ssl3_CleanupPeerCerts', 'SECKEY_UpdateCertPQG', 'tls13_HandleCertificateEntry', 'ssl3_ConsumeHandshakeVariable', 'ssl3_AuthCertificate', 'getpid', 'tls13_SetHsState', 'SECITEM_ArenaDupItem_Util', 'ssl_Trace', 'ssl_CipherSpecReleaseByEpoch', 'CERT_NewTempCertificate', 'dtls_ReceivedFirstMessageInFlight', 'PORT_ArenaAlloc_Util', 'PORT_NewArena_Util', 'SECITEM_CopyItem_Util', 'ssl3_SendAlertForCertError', 'PR_Assert', 'tls13_FatalError', 'SECITEM_CompareItem_Util', 'ssl3_HandleNoCertificate', 'PORT_SetError_Util', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl_Time']	21516	110489	tls13_HandleCertificate	call site: 11226	/src/nss/out/Debug/../../lib/ssl/tls13con.c:4157
20777	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	20777	126359	tls13_HandleCertificateVerify	call site: 11468	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
17500	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	17500	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
14124	89633	12 : View List ['PORT_Free_Util', 'PORT_ZAlloc_Util', 'tls13_FatalError', 'getpid', 'PORT_SetError_Util', 'tls13_HandleCertificate', 'ssl_HashPostHandshakeMessage', 'PORT_GetError_Util', 'ssl_Trace', 'ssl3_mapCertificateCompressionAlgorithmToName', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf']	14124	89633	tls13_HandleCertificateDecode	call site: 11318	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3997
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 09520	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
8361	8361	1 : View List ['dtls_HandleHelloVerifyRequest']	8361	8361	ssl3_HandlePostHelloHandshakeMessage	call site: 09965	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12788
7944	14832	7 : View List ['tls13_VerifyFinished', 'tls13_ComputeHandshakeHashes', 'ssl_HashPostHandshakeMessage', 'ssl_Trace', 'getpid', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage']	7944	14832	tls13_CommonHandleFinished	call site: 11720	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5685
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

2440

Functions that are reachable but not covered

831

Reachable functions

2092

Percentage of reachable functions covered

60.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_client.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	4
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	12
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	37
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	24
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	224
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	122
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	11
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	30
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	23
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	4
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	27
/src/nss/out/Debug/../../lib/ssl/sslcert.c	8
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.h	28
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/util/nssb64d.c	13
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	28
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	4
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	20
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	14
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/util/secalgid.c	3
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	3
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	351	41.8%
gold	[1:9]	193	23.0%
yellow	[10:29]	17	2.02%
greenyellow	[30:49]	1	0.11%
lawngreen	50+	276	32.9%
All colors	838	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 00610	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
5532	7376	3 : View List ['PR_Lock', 'PR_Assert', 'PR_Unlock']	5532	10142	_PR_Getfd	call site: 00311	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c:59
1844	3692	2 : View List ['PR_Assert', 'PORT_SetError_Util']	1844	5689	sec_asn1d_during_choice	call site: 00805	/src/nss/out/Debug/../../lib/util/secasn1d.c:2615
944	1866	2 : View List ['PR_SetError', 'PR_WaitCondVar']	944	3710	PR_CallOnce	call site: 00512	/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c:716
929	929	1 : View List ['PORT_Alloc_Util']	929	929	sec_asn1d_alloc	call site: 00583	/src/nss/out/Debug/../../lib/util/secasn1d.c:323
928	928	1 : View List ['PL_FinishArenaPool']	928	3704	PORT_FreeArena_Util	call site: 00550	/src/nss/out/Debug/../../lib/util/secport.c:417
928	928	1 : View List ['PL_FinishArenaPool']	928	928	PORT_DestroyCheapArena	call site: 00835	/src/nss/out/Debug/../../lib/util/secport.c:433
926	1848	4 : View List ['pthread_cond_destroy', 'PR_Free', 'pthread_mutex_destroy', '_MD_unix_map_default_error']	926	1848	PR_NewMonitor	call site: 00270	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c:482
925	925	1 : View List ['PORT_Free_Util']	925	925	sec_asn1d_add_to_subitems	call site: 00718	/src/nss/out/Debug/../../lib/util/secasn1d.c:1736
924	924	2 : View List ['fcntl', 'PR_Assert']	942	944	pt_SetMethods	call site: 00323	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c:3327
922	922	1 : View List ['PR_Realloc']	2766	5532	ExpandMonitorCache	call site: 00261	/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c:123
922	922	1 : View List ['pt_PostNotifiesFromMonitor']	1846	2768	PR_ExitMonitor	call site: 00429	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c:618

Runtime coverage analysis

Covered functions

131

Functions that are reachable but not covered

102

Reachable functions

233

Percentage of reachable functions covered

56.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/asn1.cc	1
/src/nss/out/Debug/../../lib/util/secport.c	18
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	4
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	4
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	12
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	18
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	3
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	3
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	4
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/util/secasn1u.c	1

Fuzzer: /src/nss/out/Debug/../../fuzz/targets/certDN.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	399	39.4%
gold	[1:9]	220	21.7%
yellow	[10:29]	21	2.07%
greenyellow	[30:49]	8	0.79%
lawngreen	50+	363	35.9%
All colors	1011	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20813	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	20813	95509	tls13_HandleCertificateRequest	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16907	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	16907	126359	tls13_HandleCertificateVerify	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00000	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	14759	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	12837	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 00000	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 00000	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 00000	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

3475

Functions that are reachable but not covered

87

Reachable functions

312

Percentage of reachable functions covered

72.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/certDN.cc	1
/src/nss/out/Debug/../../lib/util/secoid.c	12
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	3
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	4
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	4
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	4
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	3
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	4
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/util/secport.c	23
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/util/nssrwlk.c	4
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	8
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	8
/src/nss/out/Debug/../../lib/util/secitem.c	9
/src/nss/out/Debug/../../lib/certdb/alg1485.c	29
/src/nss/out/Debug/../../lib/certdb/secname.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/util/oidstring.c	1
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nss/out/Debug/../../lib/util/dersubr.c	2
/src/nss/out/Debug/../../lib/certhigh/certhtml.c	1
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	1

Fuzzer: /src/nss/out/Debug/../../fuzz/targets/quickder.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	288	48.0%
gold	[1:9]	194	32.3%
yellow	[10:29]	15	2.5%
greenyellow	[30:49]	1	0.16%
lawngreen	50+	102	17.0%
All colors	600	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20813	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	20813	95509	tls13_HandleCertificateRequest	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16907	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	16907	126359	tls13_HandleCertificateVerify	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00000	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	14759	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	12837	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 00000	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 00000	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 00000	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

3475

Functions that are reachable but not covered

75

Reachable functions

189

Percentage of reachable functions covered

60.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/quickder.cc	1
/src/nss/out/Debug/../../lib/util/secport.c	6
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	4
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	4
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	4
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	12
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	17
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	3
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	3
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	4
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/util/secasn1u.c	1

Fuzzer: /src/nss/out/Debug/../../fuzz/targets/smime.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2965	54.4%
gold	[1:9]	926	17.0%
yellow	[10:29]	70	1.28%
greenyellow	[30:49]	56	1.02%
lawngreen	50+	1427	26.2%
All colors	5444	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20813	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	20813	95509	tls13_HandleCertificateRequest	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16907	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	16907	126359	tls13_HandleCertificateVerify	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	14759	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 03712	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	12837	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 05291	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 03597	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 00000	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

3475

Functions that are reachable but not covered

427

Reachable functions

1241

Percentage of reachable functions covered

65.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/smime.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	36
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	66
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	40
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	21
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	23
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	6
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	27
/src/nss/out/Debug/../../lib/dev/devutil.c	26
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	14
/src/nss/out/Debug/../../lib/pki/certificate.c	13
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	16
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	13
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	10
/src/nss/out/Debug/../../lib/dev/ckhelper.c	6
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	3
/src/nss/out/Debug/../../lib/pki/pkistore.c	11
/src/nss/out/Debug/../../lib/pki/trustdomain.c	11
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	2
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	1
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	2
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/smime/cmsdecode.c	12
/src/nss/out/Debug/../../lib/smime/cmsmessage.c	4
/src/nss/out/Debug/../../lib/smime/cmscinfo.c	8
/src/nss/out/Debug/../../lib/smime/cmsenvdata.c	4
/src/nss/out/Debug/../../lib/smime/cmsrecinfo.c	3
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	18
/src/nss/out/Debug/../../lib/smime/cmssigdata.c	4
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	1
/src/nss/out/Debug/../../lib/smime/cmssiginfo.c	1
/src/nss/out/Debug/../../lib/smime/cmsencdata.c	4
/src/nss/out/Debug/../../lib/smime/cmsdigdata.c	4
/src/nss/out/Debug/../../lib/smime/cmsudf.c	9
/src/nss/out/Debug/../../lib/smime/cmsdigest.c	6
/src/nss/out/Debug/../../lib/smime/cmscipher.c	4
/src/nss/out/Debug/../../lib/util/secasn1d.c	44
/src/nss/out/Debug/../../lib/smime/cmsutil.c	5
/src/nss/out/Debug/../../lib/smime/cmsarray.c	2
/src/nss/out/Debug/../../lib/smime/smimeutil.c	17
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/smime/cmsreclist.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	23
/src/nss/out/Debug/../../lib/pk11wrap/pk11nobj.c	2
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	13
/src/nss/out/Debug/../../lib/smime/cmspubkey.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11pbe.c	17

Fuzzer: dtls-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7224	61.7%
gold	[1:9]	1005	8.59%
yellow	[10:29]	140	1.19%
greenyellow	[30:49]	70	0.59%
lawngreen	50+	3255	27.8%
All colors	11694	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
27794	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	27794	95509	tls13_HandleCertificateRequest	call site: 11046	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
21516	110489	24 : View List ['ssl3_CleanupPeerCerts', 'SECKEY_UpdateCertPQG', 'tls13_HandleCertificateEntry', 'ssl3_ConsumeHandshakeVariable', 'ssl3_AuthCertificate', 'getpid', 'tls13_SetHsState', 'SECITEM_ArenaDupItem_Util', 'ssl_Trace', 'ssl_CipherSpecReleaseByEpoch', 'CERT_NewTempCertificate', 'dtls_ReceivedFirstMessageInFlight', 'PORT_ArenaAlloc_Util', 'PORT_NewArena_Util', 'SECITEM_CopyItem_Util', 'ssl3_SendAlertForCertError', 'PR_Assert', 'tls13_FatalError', 'SECITEM_CompareItem_Util', 'ssl3_HandleNoCertificate', 'PORT_SetError_Util', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl_Time']	21516	110489	tls13_HandleCertificate	call site: 10892	/src/nss/out/Debug/../../lib/ssl/tls13con.c:4157
20777	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	20777	126359	tls13_HandleCertificateVerify	call site: 11134	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
17228	123931	25 : View List ['ssl3_ConsumeHandshake', 'CERT_DupCertificate', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'getpid', 'tls13_GetHash', 'ssl_CacheSessionID', 'PR_ntohl', 'ssl3_FillInCachedSID', 'PK11_FreeSymKey', 'ssl3_SetSIDSessionTicket', 'ssl_Trace', 'ssl3_NewSessionID', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf', 'ssl_FreeSID', 'PR_Assert', 'SECITEM_CopyItem_Util', 'tls13_FatalError', 'PORT_SetError_Util', 'tls13_HkdfExpandLabel', 'ssl_UncacheSessionID', 'tls13_GetHashSize', 'ssl_Time']	17228	123931	tls13_HandleNewSessionTicket	call site: 11318	/src/nss/out/Debug/../../lib/ssl/tls13con.c:6262
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14124	89633	12 : View List ['PORT_Free_Util', 'PORT_ZAlloc_Util', 'tls13_FatalError', 'getpid', 'PORT_SetError_Util', 'tls13_HandleCertificate', 'ssl_HashPostHandshakeMessage', 'PORT_GetError_Util', 'ssl_Trace', 'ssl3_mapCertificateCompressionAlgorithmToName', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf']	14124	89633	tls13_HandleCertificateDecode	call site: 10984	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3997
12705	27548	9 : View List ['PR_Assert', 'PK11_ConcatSymKeys', 'tls13_FatalError', 'getpid', 'PORT_SetError_Util', 'PK11_FreeSymKey', 'PORT_GetError_Util', 'ssl_Trace', 'tls13_HandleKEMCiphertext']	12705	29647	tls13_HandleServerKeyShare	call site: 09543	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3618
8694	9621	5 : View List ['PR_Assert', 'PR_GetMonitorEntryCount', 'tls13_UpdateTrafficKeys', 'ssl_Trace', 'getpid']	8694	9621	dtls13_maybeProcessKeyUpdateAck	call site: 06567	/src/nss/out/Debug/../../lib/ssl/dtls13con.c:508
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 09194	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7944	14832	7 : View List ['tls13_VerifyFinished', 'tls13_ComputeHandshakeHashes', 'ssl_HashPostHandshakeMessage', 'ssl_Trace', 'getpid', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage']	7944	14832	tls13_CommonHandleFinished	call site: 11386	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5685
7942	12605	9 : View List ['NSSRWLock_UnlockRead_Util', 'PR_Assert', 'PR_GetMonitorEntryCount', 'getpid', 'tls13_SendKeyUpdate', 'ssl_Trace', 'PR_EnterMonitor', 'NSSRWLock_LockRead_Util', 'PR_ExitMonitor']	7942	12605	tls13_CheckKeyUpdate	call site: 00000	/src/nss/out/Debug/../../lib/ssl/sslsecur.c:789

Runtime coverage analysis

Covered functions

1966

Functions that are reachable but not covered

807

Reachable functions

2049

Percentage of reachable functions covered

60.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_client.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	4
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	12
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	34
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	20
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	213
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	116
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	11
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	30
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	23
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	3
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	24
/src/nss/out/Debug/../../lib/ssl/sslcert.c	8
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.h	28
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	28
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	4
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	19
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	14
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/util/secalgid.c	3
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	3
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3

Fuzzer: quickder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	312	52.0%
gold	[1:9]	189	31.5%
yellow	[10:29]	20	3.33%
greenyellow	[30:49]	3	0.5%
lawngreen	50+	76	12.6%
All colors	600	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5532	7376	3 : View List ['PR_Lock', 'PR_Assert', 'PR_Unlock']	5532	10142	_PR_Getfd	call site: 00308	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c:59
944	1866	2 : View List ['PR_SetError', 'PR_WaitCondVar']	944	3710	PR_CallOnce	call site: 00555	/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c:716
928	928	1 : View List ['PL_FinishArenaPool']	928	928	PORT_DestroyCheapArena	call site: 00593	/src/nss/out/Debug/../../lib/util/secport.c:433
926	1848	4 : View List ['pthread_cond_destroy', 'PR_Free', 'pthread_mutex_destroy', '_MD_unix_map_default_error']	926	1848	PR_NewMonitor	call site: 00267	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c:482
924	924	2 : View List ['fcntl', 'PR_Assert']	942	944	pt_SetMethods	call site: 00320	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c:3327
922	4610	4 : View List ['PR_Lock', 'PR_GetCurrentThread', 'PR_Assert', 'PR_Unlock']	922	7391	PORT_ArenaAlloc_Util	call site: 00506	/src/nss/out/Debug/../../lib/util/secport.c:343
922	922	1 : View List ['PR_Realloc']	2766	5532	ExpandMonitorCache	call site: 00258	/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c:123
922	922	1 : View List ['pt_PostNotifiesFromMonitor']	1846	2768	PR_ExitMonitor	call site: 00426	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c:618
922	922	1 : View List ['pt_AttachThread']	1844	1844	PR_GetCurrentThread	call site: 00008	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c:589
922	922	1 : View List ['PR_Assert']	922	18207	DecodeItem	call site: 00482	/src/nss/out/Debug/../../lib/util/quickder.c:622
922	922	1 : View List ['pr_ZoneFree']	922	922	PR_Free	call site: 00057	/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c:446
4	4	2 : View List ['pthread_cond_wait', 'pthread_equal']	3694	3694	PR_EnterMonitor	call site: 00386	/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c:565

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

100

Reachable functions

189

Percentage of reachable functions covered

47.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/quickder.cc	1
/src/nss/out/Debug/../../lib/util/secport.c	6
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	4
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	4
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	4
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	12
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	17
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	3
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	3
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	4
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/util/secasn1u.c	1

Fuzzer: /src/nss/out/Debug/../../fuzz/targets/pkcs12.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4087	57.8%
gold	[1:9]	972	13.7%
yellow	[10:29]	91	1.28%
greenyellow	[30:49]	56	0.79%
lawngreen	50+	1853	26.2%
All colors	7059	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20813	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	20813	95509	tls13_HandleCertificateRequest	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16907	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	16907	126359	tls13_HandleCertificateVerify	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	14759	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	12837	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 03541	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 04851	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

3475

Functions that are reachable but not covered

537

Reachable functions

1490

Percentage of reachable functions covered

63.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/pkcs12.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	8
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	45
/src/nss/out/Debug/../../lib/certdb/crl.c	42
/src/nss/out/Debug/../../lib/util/secport.c	28
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	69
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	8
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	24
/src/nss/out/Debug/../../lib/dev/devtoken.c	26
/src/nss/out/Debug/../../lib/dev/devslot.c	10
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	12
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	28
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	30
/src/nss/out/Debug/../../lib/dev/devutil.c	29
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	26
/src/nss/out/Debug/../../lib/pki/pki3hack.c	24
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	6
/src/nss/out/Debug/../../lib/util/secoid.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	20
/src/nss/out/Debug/../../lib/certdb/secname.c	13
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	7
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	29
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	17
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	14
/src/nss/out/Debug/../../lib/base/utf8.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	10
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	11
/src/nss/out/Debug/../../lib/pki/pkistore.c	25
/src/nss/out/Debug/../../lib/pki/trustdomain.c	16
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	3
/src/nss/out/Debug/../../lib/util/nsshash.c	3
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	2
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	13
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/pkcs12/p12d.c	49
/src/nss/out/Debug/../../lib/util/secasn1d.c	47
/src/nss/out/Debug/../../lib/pkcs7/p7decode.c	16
/src/nss/out/Debug/../../lib/pkcs7/p7local.c	8
/src/nss/out/Debug/../../lib/pkcs7/p7common.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	25
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	18
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	27
/src/nss/out/Debug/../../lib/pk11wrap/pk11pbe.c	23
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pkcs12/p12local.c	6
/src/nss/out/Debug/../../lib/pkcs12/p12plcy.c	3
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	1
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	15
/src/nss/out/Debug/../../lib/util/pkcs11uri.c	18
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3
/src/nss/out/Debug/../../lib/certhigh/certvfypkix.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	25
/src/nss/out/Debug/../../lib/util/secdig.c	2
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	3
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11nobj.c	4
/src/nss/out/Debug/../../lib/certhigh/crlv2.c	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7

Fuzzer: /src/nss/out/Debug/../../fuzz/targets/pkcs7.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2669	50.6%
gold	[1:9]	922	17.4%
yellow	[10:29]	71	1.34%
greenyellow	[30:49]	40	0.75%
lawngreen	50+	1571	29.7%
All colors	5273	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20813	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	20813	95509	tls13_HandleCertificateRequest	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16907	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	16907	126359	tls13_HandleCertificateVerify	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	14759	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	12837	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 03545	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 00000	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

3475

Functions that are reachable but not covered

380

Reachable functions

1219

Percentage of reachable functions covered

68.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/pkcs7.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	8
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	3
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	12
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	7
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	40
/src/nss/out/Debug/../../lib/certdb/crl.c	42
/src/nss/out/Debug/../../lib/util/secport.c	27
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	64
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	8
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	19
/src/nss/out/Debug/../../lib/dev/devtoken.c	17
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	27
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	6
/src/nss/out/Debug/../../lib/util/secoid.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	16
/src/nss/out/Debug/../../lib/certdb/secname.c	13
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	7
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	29
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	16
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	2
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	8
/src/nss/out/Debug/../../lib/dev/ckhelper.c	5
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	13
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	2
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	2
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/pkcs7/certread.c	6
/src/nss/out/Debug/../../lib/util/secasn1d.c	42
/src/nss/out/Debug/../../lib/util/nssb64d.c	14
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	14
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	24
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/certhigh/certvfypkix.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	19
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	3
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/util/secdig.c	2
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	3
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11nobj.c	1
/src/nss/out/Debug/../../lib/certhigh/crlv2.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	3
/src/nss/out/Debug/../../lib/util/portreg.c	8

Fuzzer: tls-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6954	56.8%
gold	[1:9]	1420	11.6%
yellow	[10:29]	251	2.05%
greenyellow	[30:49]	85	0.69%
lawngreen	50+	3528	28.8%
All colors	12238	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
29369	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	29369	126359	tls13_HandleCertificateVerify	call site: 11679	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
27354	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	27354	95509	tls13_HandleCertificateRequest	call site: 11591	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
17500	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	17500	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 08680	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
11627	15880	7 : View List ['ssl_FindServerCert', 'CERT_DupCertificate', 'SECITEM_CompareItem_Util', 'tls13_RestoreCipherInfo', 'tls13_RecoverWrappedSharedSecret', 'ssl3_RegisterExtensionSender', 'tls13_ComputeEarlySecretsWithPsk']	35269	138969	tls13_HandleClientHelloPart2	call site: 08625	/src/nss/out/Debug/../../lib/ssl/tls13con.c:2348
9115	10039	2 : View List ['PR_GetError', 'ssl3_HandleServerHello']	9115	16845	ssl3_HandleHandshakeMessage	call site: 07633	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12727
8361	8361	1 : View List ['dtls_HandleHelloVerifyRequest']	8361	8361	ssl3_HandlePostHelloHandshakeMessage	call site: 10426	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12788
8324	8324	1 : View List ['ssl3_HandleHelloRequest']	8324	8324	ssl3_HandlePostHelloHandshakeMessage	call site: 10423	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12779
7510	7510	1 : View List ['ssl3_HandleServerHelloDone']	7510	7510	ssl3_HandlePostHelloHandshakeMessage	call site: 10831	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12823
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

2464

Functions that are reachable but not covered

755

Reachable functions

2163

Percentage of reachable functions covered

65.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_server.cc	4
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	8
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	6
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	15
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	27
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	34
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	20
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	39
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	24
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	214
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prshma.c	1
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/uxshm.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmmap.c	4
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	9
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	4
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	116
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	12
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	33
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	3
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	24
/src/nss/out/Debug/../../lib/ssl/sslcert.c	19
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_certs.cc	2
/src/nss/out/Debug/../../cpputil/cpputil.h	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nss/out/Debug/../../lib/util/secalgid.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	16
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.h	22
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	19
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3

Fuzzer: tls-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6778	57.7%
gold	[1:9]	1082	9.21%
yellow	[10:29]	153	1.30%
greenyellow	[30:49]	94	0.80%
lawngreen	50+	3638	30.9%
All colors	11745	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20777	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	20777	126359	tls13_HandleCertificateVerify	call site: 11185	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
17500	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	17500	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 09245	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
8361	8361	1 : View List ['dtls_HandleHelloVerifyRequest']	8361	8361	ssl3_HandlePostHelloHandshakeMessage	call site: 09683	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12788
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065
7154	7154	1 : View List ['tls13_ServerHandleFinished']	7154	7154	tls13_HandlePostHelloHandshakeMessage	call site: 11366	/src/nss/out/Debug/../../lib/ssl/tls13con.c:1320
6958	6958	3 : View List ['dtls13_HandleOutOfEpochRecord', 'getpid', 'ssl_Trace']	14698	47213	ssl3_HandleRecord	call site: 06583	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:13764
6540	6540	3 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'sftk_IsSafePrime']	7462	38010	NSC_DeriveKey	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:8760
6419	7489	3 : View List ['SECKEY_DestroyPrivateKey', 'ssl3_UpdatePostHandshakeHashes', 'tls13_SendCertificateVerify']	8277	31829	tls13_SendClientSecondFlight	call site: 11159	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5911
6342	10100	6 : View List ['PORT_ArenaAlloc_Util', 'PORT_Free_Util', 'sftk_getDBForTokenObject', 'sftkdb_GetAttributeValue', 'PORT_Alloc_Util', 'sftk_freeDB']	6342	10100	sftk_MultipleAttribute2SecItem	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11u.c:443

Runtime coverage analysis

Covered functions

2370

Functions that are reachable but not covered

785

Reachable functions

2062

Percentage of reachable functions covered

61.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_client.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	4
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	12
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	34
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	20
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	213
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	116
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	11
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	30
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	23
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	3
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	24
/src/nss/out/Debug/../../lib/ssl/sslcert.c	8
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.h	28
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/util/nssb64d.c	13
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	28
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	4
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	19
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	14
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/util/secalgid.c	3
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	3
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3

Fuzzer: pkcs8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2491	64.9%
gold	[1:9]	862	22.4%
yellow	[10:29]	74	1.93%
greenyellow	[30:49]	5	0.13%
lawngreen	50+	401	10.4%
All colors	3833	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
7315	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7315	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065
6342	10100	6 : View List ['PORT_ArenaAlloc_Util', 'PORT_Free_Util', 'sftk_getDBForTokenObject', 'sftkdb_GetAttributeValue', 'PORT_Alloc_Util', 'sftk_freeDB']	6342	10100	sftk_MultipleAttribute2SecItem	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11u.c:443
5825	11487	7 : View List ['PK11_GetNextSafe', 'PK11_DoesMechanism', 'pk11_filterSlot', 'PORT_SetError_Util', 'PK11_Authenticate', 'PORT_GetError_Util', 'PK11_IsPresent']	7977	14710	PK11_GetBestSlotMultipleWithAttributes	call site: 02302	/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c:2425
5532	7376	3 : View List ['PR_Lock', 'PR_Assert', 'PR_Unlock']	5532	10142	_PR_Getfd	call site: 00308	/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c:59
5330	6295	7 : View List ['sftk_checkNeedLogin', 'sftkdb_GetUpdateID', 'sftk_freeDB', 'sftk_isBlank', 'sftkdb_HasPasswordSet', 'sftkdb_NeedUpdateDBPassword', 'sftk_setStringName']	5330	6295	NSC_GetTokenInfo	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:3925
5313	5313	2 : View List ['sftkdb_HasPasswordSet', 'sftk_hasNullPassword']	5313	5313	SFTK_SlotReInit	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:2902
5307	6484	3 : View List ['secmod_handleReload', 'secmod_FindModuleByFuncPtr', 'SECMOD_DestroyModule']	5307	9394	secmod_ModuleInit	call site: 00620	/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c:246
5306	8083	4 : View List ['nss_MkConfigString', 'PORT_ZAlloc_Util', 'SECMOD_RestartModules', 'PORT_SetError_Util']	14955	37879	nss_Init	call site: 00584	/src/nss/out/Debug/../../lib/nss/nssinit.c:632
3807	12003	7 : View List ['nssToken_Destroy', 'PK11_GetSlotInfo', 'PK11_EnterSlotMonitor', 'nssToken_IsPresent', 'PK11_ExitSlotMonitor', 'PK11_InitToken', 'PK11Slot_GetNSSToken']	3807	12003	pk11_IsPresentCertLoad	call site: 00871	/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c:1624
3807	3807	1 : View List ['PK11_GetAllTokens']	11784	21290	PK11_GetBestSlotMultipleWithAttributes	call site: 01453	/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c:2373
3807	3807	1 : View List ['PK11_Authenticate']	3807	6705	PK11_MakePrivKey	call site: 03810	/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c:963

Runtime coverage analysis

Covered functions

685

Functions that are reachable but not covered

483

Reachable functions

902

Percentage of reachable functions covered

46.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/pkcs8.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	25
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	63
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	13
/src/nss/out/Debug/../../lib/dev/devtoken.c	16
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	14
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	6
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	10
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	12
/src/nss/out/Debug/../../lib/pki/certificate.c	9
/src/nss/out/Debug/../../lib/pki/pki3hack.c	16
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	1
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	15
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	1
/src/nss/out/Debug/../../lib/base/utf8.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	7
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	3
/src/nss/out/Debug/../../lib/pki/pkistore.c	11
/src/nss/out/Debug/../../lib/pki/trustdomain.c	7
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	2
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	1
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	2
/src/nss/out/Debug/../../lib/pki/certdecode.c	1
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	2
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	2

Fuzzer: /src/nss/out/Debug/../../fuzz/targets/asn1.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	326	38.9%
gold	[1:9]	197	23.5%
yellow	[10:29]	17	2.02%
greenyellow	[30:49]	1	0.11%
lawngreen	50+	297	35.4%
All colors	838	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20813	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	20813	95509	tls13_HandleCertificateRequest	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16907	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	16907	126359	tls13_HandleCertificateVerify	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00000	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	14759	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	12837	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 00610	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 00000	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 00000	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

3475

Functions that are reachable but not covered

75

Reachable functions

233

Percentage of reachable functions covered

67.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/asn1.cc	1
/src/nss/out/Debug/../../lib/util/secport.c	18
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	4
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	4
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	12
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	18
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	3
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	3
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	4
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/util/secasn1u.c	1

Fuzzer: dtls-client-no_fuzzer_mode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7488	62.5%
gold	[1:9]	1018	8.50%
yellow	[10:29]	162	1.35%
greenyellow	[30:49]	77	0.64%
lawngreen	50+	3231	26.9%
All colors	11976	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
27794	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	27794	95509	tls13_HandleCertificateRequest	call site: 11329	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
26992	123931	25 : View List ['ssl3_ConsumeHandshake', 'CERT_DupCertificate', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'getpid', 'tls13_GetHash', 'ssl_CacheSessionID', 'PR_ntohl', 'ssl3_FillInCachedSID', 'PK11_FreeSymKey', 'ssl3_SetSIDSessionTicket', 'ssl_Trace', 'ssl3_NewSessionID', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf', 'ssl_FreeSID', 'PR_Assert', 'SECITEM_CopyItem_Util', 'tls13_FatalError', 'PORT_SetError_Util', 'tls13_HkdfExpandLabel', 'ssl_UncacheSessionID', 'tls13_GetHashSize', 'ssl_Time']	26992	123931	tls13_HandleNewSessionTicket	call site: 11601	/src/nss/out/Debug/../../lib/ssl/tls13con.c:6262
25566	56350	18 : View List ['NSS_SecureMemcmp', 'ssl3_SendChangeCipherSpecs', 'PR_GetCurrentThread', 'ssl3_ComputeHandshakeHashes', 'ssl3_ExtensionNegotiated', 'ssl3_KEASupportsTickets', 'ssl3_SendFinished', 'dtls_ReceivedFirstMessageInFlight', 'ssl3_FinishHandshake', 'PR_Assert', 'ssl3_ComputeTLSFinished', 'ssl_HashHandshakeMessage', 'ssl3_SendNextProto', 'ssl3_SendNewSessionTicket', 'ssl3_IllegalParameter', 'PR_EnterMonitor', 'ssl3_HandshakeFailure', 'PR_ExitMonitor']	25566	75506	ssl3_HandleFinished	call site: 10880	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12326
21516	110489	24 : View List ['ssl3_CleanupPeerCerts', 'SECKEY_UpdateCertPQG', 'tls13_HandleCertificateEntry', 'ssl3_ConsumeHandshakeVariable', 'ssl3_AuthCertificate', 'getpid', 'tls13_SetHsState', 'SECITEM_ArenaDupItem_Util', 'ssl_Trace', 'ssl_CipherSpecReleaseByEpoch', 'CERT_NewTempCertificate', 'dtls_ReceivedFirstMessageInFlight', 'PORT_ArenaAlloc_Util', 'PORT_NewArena_Util', 'SECITEM_CopyItem_Util', 'ssl3_SendAlertForCertError', 'PR_Assert', 'tls13_FatalError', 'SECITEM_CompareItem_Util', 'ssl3_HandleNoCertificate', 'PORT_SetError_Util', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl_Time']	21516	110489	tls13_HandleCertificate	call site: 11175	/src/nss/out/Debug/../../lib/ssl/tls13con.c:4157
20777	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	20777	126359	tls13_HandleCertificateVerify	call site: 11417	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14124	89633	12 : View List ['PORT_Free_Util', 'PORT_ZAlloc_Util', 'tls13_FatalError', 'getpid', 'PORT_SetError_Util', 'tls13_HandleCertificate', 'ssl_HashPostHandshakeMessage', 'PORT_GetError_Util', 'ssl_Trace', 'ssl3_mapCertificateCompressionAlgorithmToName', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf']	14124	89633	tls13_HandleCertificateDecode	call site: 11267	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3997
12705	27548	9 : View List ['PR_Assert', 'PK11_ConcatSymKeys', 'tls13_FatalError', 'getpid', 'PORT_SetError_Util', 'PK11_FreeSymKey', 'PORT_GetError_Util', 'ssl_Trace', 'tls13_HandleKEMCiphertext']	12705	29647	tls13_HandleServerKeyShare	call site: 09825	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3618
8694	9621	5 : View List ['PR_Assert', 'PR_GetMonitorEntryCount', 'tls13_UpdateTrafficKeys', 'ssl_Trace', 'getpid']	8694	9621	dtls13_maybeProcessKeyUpdateAck	call site: 06793	/src/nss/out/Debug/../../lib/ssl/dtls13con.c:508
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 09469	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7944	14832	7 : View List ['tls13_VerifyFinished', 'tls13_ComputeHandshakeHashes', 'ssl_HashPostHandshakeMessage', 'ssl_Trace', 'getpid', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage']	7944	14832	tls13_CommonHandleFinished	call site: 11669	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5685

Runtime coverage analysis

Covered functions

2290

Functions that are reachable but not covered

835

Reachable functions

2079

Percentage of reachable functions covered

59.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_client.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	4
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	12
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	37
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	24
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	224
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	122
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	11
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	30
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	23
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	4
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	27
/src/nss/out/Debug/../../lib/ssl/sslcert.c	8
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/client_config.h	28
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	28
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	4
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	20
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	14
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/util/secalgid.c	3
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	3
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3

Fuzzer: /src/nss/out/Debug/../../fuzz/targets/pkcs8.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1970	51.3%
gold	[1:9]	843	21.9%
yellow	[10:29]	41	1.06%
greenyellow	[30:49]	21	0.54%
lawngreen	50+	958	24.9%
All colors	3833	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20813	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	20813	95509	tls13_HandleCertificateRequest	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
16907	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	16907	126359	tls13_HandleCertificateVerify	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
14759	15693	6 : View List ['NSS_CMSCipherContext_StartDecrypt', 'NSS_CMSContentInfo_GetContentEncAlgTag', 'NSS_CMSContentInfo_GetContentEncAlg', 'NSS_CMSContentInfo_Private_Init', 'NSS_CMSContentInfo_SetBulkKey', 'NSS_CMSRecipientInfo_UnwrapBulkKey']	14759	19049	NSS_CMSEnvelopedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsenvdata.c:324
13480	49961	18 : View List ['SECKEY_DestroyPublicKey', 'ssl_UnwrapSymWrappingKey', 'SECKEY_CreateECPrivateKey', 'SECKEY_DestroyPrivateKey', 'PK11_WrapSymKey', 'PK11_KeyGen', 'PK11_FreeSymKey', 'ssl_MapLowLevelError', 'PK11_PubDeriveWithKDF', 'PR_Assert', 'PK11_GetBestKeyLength', 'SECKEY_GetPublicKeyType', 'PORT_SetError_Util', 'PK11_PubWrapSymKey', 'ssl_SetWrappingKey', 'ssl_GetWrappingKey', 'SECKEY_PublicKeyStrength', 'SECKEY_PublicKeyStrengthInBits']	13480	50885	ssl3_GetWrappingKey	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:6101
12837	13769	4 : View List ['NSS_CMSContentInfo_Private_Init', 'NSS_CMSCipherContext_StartDecrypt', 'NSS_SMIMEUtil_DecryptionAllowed', 'NSS_CMSContentInfo_SetBulkKey']	12837	14852	NSS_CMSEncryptedData_Decode_BeforeData	call site: 00000	/src/nss/out/Debug/../../lib/smime/cmsencdata.c:227
11064	11999	4 : View List ['sec_asn1d_notify_before', 'PR_Assert', 'sec_asn1d_notify_after', 'SEC_ASN1GetSubtemplate']	11064	15940	sec_asn1d_init_state_based_on_template	call site: 03541	/src/nss/out/Debug/../../lib/util/secasn1d.c:467
8941	9865	2 : View List ['SEC_PKCS7VerifySignature', 'PORT_SetError_Util']	8941	9865	SEC_PKCS12DecoderVerify	call site: 00000	/src/nss/out/Debug/../../lib/pkcs12/p12d.c:1467
8374	18141	8 : View List ['ssl_FreeSID', 'PR_Assert', 'SSL_AtomicIncrementLong', 'ssl_UncacheSessionID', 'tls13_RecoverWrappedSharedSecret', 'ssl3_SetupCipherSuite', 'PORT_GetError_Util', 'ssl_TicketTimeValid']	11161	47379	tls13_SetupClientHello	call site: 00000	/src/nss/out/Debug/../../lib/ssl/tls13con.c:617
7412	16703	6 : View List ['KEA_PrimeCheck', 'KEA_Verify', 'SECITEM_ZfreeItem_Util', 'sftk_VerifyDH_Prime', 'SECITEM_CompareItem_Util', 'sftk_Attribute2SecItem']	7412	17637	sftk_PairwiseConsistencyCheck	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11c.c:5409
7298	18183	10 : View List ['secmod_sanityCheckCryptoPolicy', 'PR_SetEnv', 'NSSUTIL_ArgGetParamValue', 'PORT_Free_Util', 'NSSUTIL_ArgHasFlag', 'NSS_OptionGet', 'SECOID_Init', 'NSS_LockPolicy', 'NSS_OptionSet', 'secmod_applyCryptoPolicy']	7298	18183	secmod_parseCryptoPolicy	call site: 02704	/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c:1065

Runtime coverage analysis

Covered functions

3475

Functions that are reachable but not covered

296

Reachable functions

902

Percentage of reachable functions covered

67.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/pkcs8.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	5
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	6
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	19
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	2
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	2
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	1
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	1
/src/nss/out/Debug/../../lib/certdb/certdb.c	25
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	26
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	10
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	31
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	6
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	63
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	13
/src/nss/out/Debug/../../lib/dev/devtoken.c	16
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	14
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	6
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	10
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	12
/src/nss/out/Debug/../../lib/pki/certificate.c	9
/src/nss/out/Debug/../../lib/pki/pki3hack.c	16
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	1
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	18
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	15
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	1
/src/nss/out/Debug/../../lib/base/utf8.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	7
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	3
/src/nss/out/Debug/../../lib/pki/pkistore.c	11
/src/nss/out/Debug/../../lib/pki/trustdomain.c	7
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	2
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	1
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	2
/src/nss/out/Debug/../../lib/pki/certdecode.c	1
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nss/out/Debug/../../lib/util/secalgid.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	2
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	2

Fuzzer: dtls-server-no_fuzzer_mode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7272	58.1%
gold	[1:9]	1485	11.8%
yellow	[10:29]	216	1.72%
greenyellow	[30:49]	42	0.33%
lawngreen	50+	3500	27.9%
All colors	12515	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
40513	56350	18 : View List ['NSS_SecureMemcmp', 'ssl3_SendChangeCipherSpecs', 'PR_GetCurrentThread', 'ssl3_ComputeHandshakeHashes', 'ssl3_ExtensionNegotiated', 'ssl3_KEASupportsTickets', 'ssl3_SendFinished', 'dtls_ReceivedFirstMessageInFlight', 'ssl3_FinishHandshake', 'PR_Assert', 'ssl3_ComputeTLSFinished', 'ssl_HashHandshakeMessage', 'ssl3_SendNextProto', 'ssl3_SendNewSessionTicket', 'ssl3_IllegalParameter', 'PR_EnterMonitor', 'ssl3_HandshakeFailure', 'PR_ExitMonitor']	40513	75506	ssl3_HandleFinished	call site: 11430	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:12326
29369	126359	24 : View List ['SECKEY_DestroyPublicKey', 'ssl_SetAuthKeyBits', 'ssl3_ConsumeHandshakeVariable', 'ssl_CheckSignatureSchemeConsistency', 'tls13_SetHsState', 'getpid', 'SECKEY_ExtractPublicKey', 'tls13_VerifyDelegatedCredential', 'tls13_IsVerifyingWithDelegatedCredential', 'ssl_SignatureSchemeToAuthType', 'ssl_MapLowLevelError', 'ssl_Trace', 'tls13_ComputeHandshakeHashes', 'ssl_ConsumeSignatureScheme', 'ssl_VerifySignedHashesWithPubKey', 'PR_Assert', 'tls13_AddContextToHashes', 'tls13_FatalError', 'PORT_SetError_Util', 'ssl_HashHandshakeMessage', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'ssl_SignatureSchemeToHashType']	29369	126359	tls13_HandleCertificateVerify	call site: 11957	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5255
27354	95509	20 : View List ['SECITEM_FreeItem_Util', 'PK11_CloneContext', 'SECKEY_DestroyPrivateKey', 'PORT_Free_Util', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'tls13_SetHsState', 'getpid', 'ssl_MapLowLevelError', 'ssl_Trace', 'PR_Assert', 'SECITEM_CopyItem_Util', 'CERT_DestroyCertificate', 'tls13_FatalError', 'tls13_SendPostHandshakeCertificate', 'PORT_SetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl3_BeginHandleCertificateRequest', 'CERT_DestroyCertificateList']	27354	95509	tls13_HandleCertificateRequest	call site: 11869	/src/nss/out/Debug/../../lib/ssl/tls13con.c:3127
26545	50334	19 : View List ['tls13_FinishHandshake', 'getpid', 'tls13_SetHsState', 'tls13_ComputeFinalSecrets', 'PK11_DestroyContext', 'ssl3_FlushHandshake', 'tls13_SendKeyUpdate', 'dtls_StartTimer', 'ssl_Trace', 'ssl_CipherSpecReleaseByEpoch', 'dtls_ReceivedFirstMessageInFlight', 'PR_Assert', 'tls13_FatalError', 'PORT_SetError_Util', 'tls13_ShouldRequestClientAuth', 'tls13_SendNewSessionTicket', 'tls13_SetCipherSpec', 'PR_EnterMonitor', 'PR_ExitMonitor']	26545	50334	tls13_ServerHandleFinished	call site: 12208	/src/nss/out/Debug/../../lib/ssl/tls13con.c:5758
21012	123931	25 : View List ['ssl3_ConsumeHandshake', 'CERT_DupCertificate', 'ssl3_ConsumeHandshakeVariable', 'tls13_IsPostHandshake', 'ssl3_HandleExtensions', 'getpid', 'tls13_GetHash', 'ssl_CacheSessionID', 'PR_ntohl', 'ssl3_FillInCachedSID', 'PK11_FreeSymKey', 'ssl3_SetSIDSessionTicket', 'ssl_Trace', 'ssl3_NewSessionID', 'ssl3_ConsumeHandshakeNumber', 'ssl_PrintBuf', 'ssl_FreeSID', 'PR_Assert', 'SECITEM_CopyItem_Util', 'tls13_FatalError', 'PORT_SetError_Util', 'tls13_HkdfExpandLabel', 'ssl_UncacheSessionID', 'tls13_GetHashSize', 'ssl_Time']	21012	123931	tls13_HandleNewSessionTicket	call site: 12141	/src/nss/out/Debug/../../lib/ssl/tls13con.c:6262
16720	16720	1 : View List ['sftk_CreateNewSlot']	16720	17684	NSC_CreateObject	call site: 00000	/src/nss/out/Debug/../../lib/softoken/pkcs11.c:4872
16594	34098	12 : View List ['SECITEM_FreeItem_Util', 'ssl_FindServerCert', 'CERT_DupCertificate', 'SECITEM_CopyItem_Util', 'ssl3_UnwrapMasterSecretServer', 'PR_Assert', 'ssl3_SendServerHello', 'ssl3_SendChangeCipherSpecs', 'ssl3_InitPendingCipherSpecs', 'ssl_LookupNamedGroup', 'ssl3_FreeSniNameArray', 'ssl3_SendFinished']	16594	86297	ssl3_HandleClientHelloPart2	call site: 09693	/src/nss/out/Debug/../../lib/ssl/ssl3con.c:9571
16571	35978	18 : View List ['nssToken_Destroy', 'nssToken_GetDefaultSession', 'PR_IntervalNow', 'PR_NotifyAllCondVar', 'PR_GetCurrentThread', 'nssTrustDomain_UpdateCachedTokenCerts', 'PR_Unlock', 'nssSession_ExitMonitor', 'PR_Lock', 'nssToken_NotifyCertsNotVisible', 'token_status_checked', 'nssToken_Remove', 'PK11Slot_GetNSSToken', 'PK11_GetSlotInfo', 'nssSession_EnterMonitor', 'nssToken_Refresh', 'PR_WaitCondVar', 'PK11_InitToken']	16571	35978	nssSlot_IsTokenPresent	call site: 00878	/src/nss/out/Debug/../../lib/dev/devslot.c:130
15623	110489	24 : View List ['ssl3_CleanupPeerCerts', 'SECKEY_UpdateCertPQG', 'tls13_HandleCertificateEntry', 'ssl3_ConsumeHandshakeVariable', 'ssl3_AuthCertificate', 'getpid', 'tls13_SetHsState', 'SECITEM_ArenaDupItem_Util', 'ssl_Trace', 'ssl_CipherSpecReleaseByEpoch', 'CERT_NewTempCertificate', 'dtls_ReceivedFirstMessageInFlight', 'PORT_ArenaAlloc_Util', 'PORT_NewArena_Util', 'SECITEM_CopyItem_Util', 'ssl3_SendAlertForCertError', 'PR_Assert', 'tls13_FatalError', 'SECITEM_CompareItem_Util', 'ssl3_HandleNoCertificate', 'PORT_SetError_Util', 'PORT_GetError_Util', 'ssl_HashPostHandshakeMessage', 'ssl_Time']	15623	110489	tls13_HandleCertificate	call site: 11715	/src/nss/out/Debug/../../lib/ssl/tls13con.c:4157
12568	14422	4 : View List ['PR_Assert', 'tls13_ComputePskBinderHash', 'tls13_VerifyFinished', 'tls13_GetHash']	21253	86362	tls13_HandleClientHelloPart2	call site: 09123	/src/nss/out/Debug/../../lib/ssl/tls13con.c:2410
11634	15880	7 : View List ['ssl_FindServerCert', 'CERT_DupCertificate', 'SECITEM_CompareItem_Util', 'tls13_RestoreCipherInfo', 'tls13_RecoverWrappedSharedSecret', 'ssl3_RegisterExtensionSender', 'tls13_ComputeEarlySecretsWithPsk']	41206	138969	tls13_HandleClientHelloPart2	call site: 08888	/src/nss/out/Debug/../../lib/ssl/tls13con.c:2348
11181	12152	8 : View List ['SECITEM_CopyItem_Util', 'SSL_AtomicIncrementLong', 'SSL_GetStatistics', 'ssl_CreateSIDFromTicket', 'ssl_ParseSessionTicket', 'getpid', 'ssl_Trace', 'ssl_Time']	11181	15456	ssl3_ProcessSessionTicketCommon	call site: 00000	/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c:1231

Runtime coverage analysis

Covered functions

2576

Functions that are reachable but not covered

754

Reachable functions

2193

Percentage of reachable functions covered

65.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/nss/out/Debug/../../fuzz/targets/tls_server.cc	4
/src/nss/out/Debug/../../fuzz/targets/lib/base/database.h	2
/src/nss/out/Debug/../../lib/nss/nssinit.c	16
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinit.c	5
/src/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c	11
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlog.c	8
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prtime.c	9
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prprf.c	13
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerror.c	6
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptthread.c	8
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptsynch.c	21
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/priometh.c	6
/src/nspr/Debug/pr/src/md/../../../../pr/src/md/prosdep.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prenv.c	4
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/linux.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/pratom.c	1
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prseg.c	1
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptmisc.c	2
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prtpd.c	5
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prlayer.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prinrval.c	8
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prcmon.c	2
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/unix_errors.c	5
/src/nspr/Debug/pr/src/pthreads/../../../../pr/src/pthreads/ptio.c	15
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prfdcach.c	2
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prnetdb.c	9
/src/nspr/Debug/pr/src/linking/../../../../pr/src/linking/prlink.c	9
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prdtoa.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmwait.c	1
/src/nspr/Debug/pr/src/threads/../../../../pr/src/threads/prrwlock.c	10
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerr.c	1
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prerrortable.c	2
/src/nss/out/Debug/../../lib/certdb/certdb.c	29
/src/nss/out/Debug/../../lib/certdb/crl.c	11
/src/nss/out/Debug/../../lib/util/secport.c	27
/src/nspr/Debug/lib/ds/../../../lib/ds/plhash.c	14
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/prlog2.c	1
/src/nss/out/Debug/../../lib/util/secitem.c	16
/src/nss/out/Debug/../../lib/certhigh/ocsp.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11load.c	9
/src/nss/out/Debug/../../lib/pk11wrap/pk11util.c	32
/src/nss/out/Debug/../../lib/pk11wrap/pk11list.c	7
/src/nss/out/Debug/../../lib/util/nssrwlk.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11pars.c	36
/src/nss/out/Debug/../../lib/util/utilpars.c	40
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strcase.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11slot.c	74
/src/nspr/Debug/lib/ds/../../../lib/ds/plarena.c	7
/src/nss/out/Debug/../../lib/pk11wrap/pk11skey.c	63
/src/nss/out/Debug/../../lib/pk11wrap/pk11obj.c	37
/src/nss/out/Debug/../../lib/dev/devtoken.c	18
/src/nss/out/Debug/../../lib/dev/devslot.c	9
/src/nss/out/Debug/../../lib/pk11wrap/dev3hack.c	10
/src/nss/out/Debug/../../lib/pk11wrap/pk11err.c	1
/src/nss/out/Debug/../../lib/pki/tdcache.c	17
/src/nss/out/Debug/../../lib/base/arena.c	17
/src/nss/out/Debug/../../lib/base/error.c	7
/src/nss/out/Debug/../../lib/base/libc.c	3
/src/nss/out/Debug/../../lib/base/hash.c	12
/src/nss/out/Debug/../../lib/pki/pkibase.c	29
/src/nss/out/Debug/../../lib/dev/devutil.c	25
/src/nss/out/Debug/../../lib/base/tracker.c	7
/src/nss/out/Debug/../../lib/base/list.c	17
/src/nss/out/Debug/../../lib/pki/certificate.c	21
/src/nss/out/Debug/../../lib/pki/pki3hack.c	21
/src/nss/out/Debug/../../lib/util/quickder.c	13
/src/nss/out/Debug/../../lib/util/secasn1u.c	3
/src/nss/out/Debug/../../lib/certdb/certxutl.c	5
/src/nss/out/Debug/../../lib/util/secoid.c	19
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strpbrk.c	1
/src/nss/out/Debug/../../lib/certdb/alg1485.c	13
/src/nss/out/Debug/../../lib/certdb/secname.c	2
/src/nss/out/Debug/../../lib/util/utf8.c	4
/src/nspr/Debug/lib/libc/src/../../../../lib/libc/src/strlen.c	1
/src/nss/out/Debug/../../lib/certdb/certv3.c	6
/src/nss/out/Debug/../../lib/certdb/xconst.c	1
/src/nss/out/Debug/../../lib/certdb/genname.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cxt.c	24
/src/nss/out/Debug/../../lib/pk11wrap/pk11mech.c	10
/src/nss/out/Debug/../../lib/base/utf8.c	3
/src/nss/out/Debug/../../lib/pk11wrap/pk11auth.c	9
/src/nss/out/Debug/../../lib/dev/ckhelper.c	4
/src/nss/out/Debug/../../lib/pki/cryptocontext.c	6
/src/nss/out/Debug/../../lib/pki/pkistore.c	20
/src/nss/out/Debug/../../lib/pki/trustdomain.c	15
/src/nss/out/Debug/../../lib/cryptohi/sechash.c	9
/src/nss/out/Debug/../../lib/util/nsshash.c	1
/src/nss/out/Debug/../../lib/certdb/polcyxtn.c	3
/src/nss/out/Debug/../../lib/certdb/xbsconst.c	1
/src/nss/out/Debug/../../lib/util/dersubr.c	3
/src/nss/out/Debug/../../lib/certdb/stanpcertdb.c	4
/src/nss/out/Debug/../../lib/pki/certdecode.c	2
/src/nss/out/Debug/../../lib/certdb/xauthkid.c	1
/src/nss/out/Debug/../../lib/util/errstrs.c	2
/src/nss/out/Debug/../../lib/nss/nssoptions.c	2
/src/nss/out/Debug/../../lib/pk11wrap/debug_module.c	3
/src/nss/out/Debug/../../lib/base/item.c	2
/src/nss/out/Debug/../../lib/pk11wrap/pk11sdr.c	2
/src/nss/out/Debug/../../lib/ssl/sslsnce.c	39
/src/nss/out/Debug/../../lib/ssl/sslnonce.c	24
/src/nss/out/Debug/../../lib/ssl/ssl3con.c	225
/src/nss/out/Debug/../../lib/ssl/sslerrstrs.c	2
/src/nspr/Debug/pr/src/memory/../../../../pr/src/memory/prshma.c	1
/src/nspr/Debug/pr/src/md/unix/../../../../../pr/src/md/unix/uxshm.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/prmmap.c	4
/src/nss/out/Debug/../../lib/ssl/sslmutex.c	9
/src/nss/out/Debug/../../lib/ssl/unix_err.c	1
/src/nspr/Debug/pr/src/io/../../../../pr/src/io/pripv6.c	4
/src/nss/out/Debug/../../lib/ssl/sslsock.c	54
/src/nss/out/Debug/../../lib/ssl/sslinit.c	3
/src/nss/out/Debug/../../lib/ssl/sslspec.c	13
/src/nss/out/Debug/../../lib/ssl/ssltrace.c	3
/src/nss/out/Debug/../../lib/ssl/ssl3ext.c	29
/src/nss/out/Debug/../../lib/ssl/dtlscon.c	39
/src/nss/out/Debug/../../lib/ssl/sslsecur.c	12
/src/nss/out/Debug/../../lib/ssl/sslencode.c	25
/src/nss/out/Debug/../../lib/ssl/ssl3gthr.c	6
/src/nss/out/Debug/../../lib/ssl/ssl3exthandle.c	4
/src/nss/out/Debug/../../lib/ssl/tls13con.c	122
/src/nss/out/Debug/../../lib/ssl/tls13subcerts.c	12
/src/nss/out/Debug/../../lib/cryptohi/seckey.c	33
/src/nss/out/Debug/../../lib/ssl/tls13ech.c	31
/src/nss/out/Debug/../../lib/certhigh/certhigh.c	6
/src/nss/out/Debug/../../lib/ssl/sslprimitive.c	4
/src/nss/out/Debug/../../lib/ssl/tls13psk.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11hpke.c	27
/src/nss/out/Debug/../../lib/ssl/sslcert.c	19
/src/nss/out/Debug/../../lib/ssl/tls13replay.c	5
/src/nss/out/Debug/../../lib/ssl/sslbloom.c	6
/src/nss/out/Debug/../../lib/ssl/ssldef.c	3
/src/nss/out/Debug/../../fuzz/targets/lib/tls/common.cc	5
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_certs.cc	2
/src/nss/out/Debug/../../cpputil/cpputil.h	1
/src/nss/out/Debug/../../lib/pk11wrap/pk11pk12.c	7
/src/nss/out/Debug/../../lib/util/secasn1d.c	41
/src/nss/out/Debug/../../lib/util/secalgid.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11akey.c	16
/src/nss/out/Debug/../../lib/util/secasn1e.c	27
/src/nss/out/Debug/../../lib/ssl/ssl3ecc.c	12
/src/nss/out/Debug/../../fuzz/targets/lib/tls/socket.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.h	1
/src/nss/out/Debug/../../cpputil/dummy_io.cc	1
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.cc	6
/src/nss/out/Debug/../../fuzz/targets/lib/tls/server_config.h	22
/src/nss/out/Debug/../../lib/freebl/det_rng.c	1
/src/nss/out/Debug/../../lib/ssl/sslauth.c	1
/src/nss/out/Debug/../../lib/ssl/dtls13con.c	20
/src/nss/out/Debug/../../lib/ssl/sslerr.c	1
/src/nss/out/Debug/../../lib/ssl/tls13hkdf.c	4
/src/nss/out/Debug/../../lib/pk11wrap/pk11kea.c	2
/src/nss/out/Debug/../../lib/ssl/sslgrp.c	5
/src/nss/out/Debug/../../lib/pk11wrap/pk11cert.c	6
/src/nss/out/Debug/../../lib/cryptohi/secsign.c	2
/src/nss/out/Debug/../../lib/cryptohi/secvfy.c	16
/src/nss/out/Debug/../../lib/util/secdig.c	3
/src/nss/out/Debug/../../lib/util/derenc.c	4
/src/nss/out/Debug/../../lib/cryptohi/dsautil.c	6
/src/nss/out/Debug/../../lib/ssl/tls13exthandle.c	12
/src/nss/out/Debug/../../lib/ssl/tls13hashstate.c	2
/src/nss/out/Debug/../../lib/ssl/selfencrypt.c	6
/src/nspr/Debug/pr/src/misc/../../../../pr/src/misc/praton.c	4
/src/nss/out/Debug/../../lib/certhigh/certvfy.c	1
/src/nss/out/Debug/../../lib/util/pkcs1sig.c	2
/src/nss/out/Debug/../../lib/util/sectime.c	1
/src/nss/out/Debug/../../lib/util/dertime.c	3