Fuzz introspector: sshsigopt_fuzz
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 2 2 opt_flag call site: 00005 /src/openssh/misc.c:2498
0 0 None 0 3 sshsigopt_parse call site: 00028 /src/openssh/sshsig.c:704
0 0 None 0 0 opt_dequote call site: 00012 /src/openssh/misc.c:2522
0 0 None 0 0 sshsigopt_parse call site: 00002 /src/openssh/sshsig.c:632

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 sshsigopt_parse [function] [call site] 00001
2 calloc [call site] 00002
2 opt_flag [function] [call site] 00003
3 strlen [call site] 00004
3 strncasecmp [call site] 00005
3 strncasecmp [call site] 00006
2 opt_match [function] [call site] 00007
3 strlen [call site] 00008
3 strlen [call site] 00009
3 strlen [call site] 00010
2 opt_dequote [function] [call site] 00011
3 strlen [call site] 00012
2 opt_match [function] [call site] 00013
2 opt_dequote [function] [call site] 00014
2 parse_absolute_time [function] [call site] 00015
3 strlen [call site] 00016
3 strcasecmp [call site] 00017
3 strcasecmp [call site] 00018
3 snprintf [call site] 00019
3 snprintf [call site] 00020
3 snprintf [call site] 00021
3 memset [call site] 00022
3 strptime [call site] 00023
3 timegm [call site] 00024
3 mktime [call site] 00025
2 opt_match [function] [call site] 00026
2 opt_dequote [function] [call site] 00027
2 parse_absolute_time [function] [call site] 00028
2 sshsigopt_free [function] [call site] 00029
1 sshsigopt_free [function] [call site] 00030