Fuzz introspector: authfd_reply_fuzz
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
47 26 sshbuf_free call site: 00026 ssh_signal
31 128 sshbuf_put_string call site: 00128 sshkey_putb
13 232 sshkey_from_blob_internal call site: 00232 sshkey_match_keyname_to_sigalgs
11 283 sshkey_from_blob_internal call site: 00283 sshbuf_putb
10 88 sshkey_free call site: 00088 pkcs11_key_free
8 160 xrecallocarray call site: 00160 helper_terminate
7 297 sshbuf_reset call site: 00297 sshbuf_get_string_direct
6 74 xcalloc call site: 00074 sshfatal
6 331 atomicio call site: 00331 __errno_location
6 395 ssh_agent_sign call site: 00395 sshkey_get_sigtype
4 3 log_init call site: 00003 fprintf
4 371 agent_encode_alg call site: 00371 strcmp

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 setup() [function] [call site] 00001
2 log_init [function] [call site] 00002
3 log_change_level [function] [call site] 00003
3 fprintf [call site] 00004
3 exit [call site] 00005
3 fprintf [call site] 00006
3 exit [call site] 00007
3 openlog [call site] 00008
3 closelog [call site] 00009
2 load_pubkey_or_die(char const*) [function] [call site] 00010
3 sshkey_new [function] [call site] 00011
4 sshkey_impl_from_type [function] [call site] 00012
4 calloc [call site] 00013
4 sshkey_is_cert [function] [call site] 00014
5 sshkey_type_is_cert [function] [call site] 00015
6 sshkey_impl_from_type [function] [call site] 00016
4 cert_new [function] [call site] 00017
5 calloc [call site] 00018
5 sshbuf_new [function] [call site] 00019
6 calloc [call site] 00020
6 calloc [call site] 00021
5 sshbuf_new [function] [call site] 00022
5 sshbuf_new [function] [call site] 00023
5 cert_free [function] [call site] 00024
6 sshbuf_free [function] [call site] 00025
7 sshbuf_check_sanity [function] [call site] 00026
8 ssh_signal [function] [call site] 00027
9 memset [call site] 00028
9 sigfillset [call site] 00029
9 sigaction [call site] 00030
9 strsignal [call site] 00031
9 __errno_location [call site] 00032
9 strerror [call site] 00033
9 sshlog [function] [call site] 00034
10 sshlogv [function] [call site] 00035
11 strrchr [call site] 00036
11 getpid [call site] 00037
11 snprintf [call site] 00038
11 match_pattern_list [function] [call site] 00039
12 strlen [call site] 00040
12 __ctype_b_loc [call site] 00041
12 tolower [call site] 00042
12 match_pattern [function] [call site] 00043
13 strlen [call site] 00044
13 xcalloc [function] [call site] 00045
14 sshfatal [function] [call site] 00046
15 sshlogv [function] [call site] 00047
16 snprintf [call site] 00048
16 snprintf [call site] 00049
16 strlcpy [function] [call site] 00050
16 do_log [function] [call site] 00051
17 __errno_location [call site] 00052
17 snprintf [call site] 00053
17 vsnprintf [call site] 00054
17 vsnprintf [call site] 00055
17 snprintf [call site] 00056
17 strlcpy [function] [call site] 00057
17 strnvis [function] [call site] 00058
18 __ctype_b_loc [call site] 00059
18 vis [function] [call site] 00060
19 __ctype_b_loc [call site] 00061
19 __ctype_b_loc [call site] 00062
18 vis [function] [call site] 00063
17 snprintf [call site] 00064
17 strlen [call site] 00065
17 write [call site] 00066
17 openlog [call site] 00067
17 syslog [call site] 00068
17 closelog [call site] 00069
17 __errno_location [call site] 00070
15 cleanup_exit [function] [call site] 00071
16 _exit [call site] 00072
14 sshfatal [function] [call site] 00073
14 calloc [call site] 00074
14 sshfatal [function] [call site] 00075
13 xcalloc [function] [call site] 00076
13 epsilon_closure [function] [call site] 00077
13 memset [call site] 00078
13 epsilon_closure [function] [call site] 00079
8 raise [call site] 00080
7 sshbuf_free [function] [call site] 00081
8 freezero [function] [call site] 00082
9 explicit_bzero [call site] 00083
8 freezero [function] [call site] 00084
6 sshbuf_free [function] [call site] 00085
6 sshbuf_free [function] [call site] 00086
6 sshkey_free [function] [call site] 00087
7 sshkey_free_contents [function] [call site] 00088
8 pkcs11_key_free [function] [call site] 00089
9 sshkey_type [function] [call site] 00090
10 sshkey_impl_from_key [function] [call site] 00091
11 sshkey_impl_from_type_nid [function] [call site] 00092
9 sshlog [function] [call site] 00093
9 helper_by_key [function] [call site] 00094
10 sshbuf_new [function] [call site] 00095
10 sshfatal [function] [call site] 00096
10 sshkey_putb [function] [call site] 00097
11 to_blob_buf [function] [call site] 00098
12 sshkey_type_plain [function] [call site] 00099
12 sshkey_type_is_cert [function] [call site] 00100
12 sshbuf_len [function] [call site] 00101
13 sshbuf_check_sanity [function] [call site] 00102
12 sshbuf_putb [function] [call site] 00103
13 sshbuf_ptr [function] [call site] 00104
14 sshbuf_check_sanity [function] [call site] 00105
13 sshbuf_len [function] [call site] 00106
13 sshbuf_put [function] [call site] 00107
14 sshbuf_reserve [function] [call site] 00108
15 sshbuf_allocate [function] [call site] 00109
16 sshbuf_check_reserve [function] [call site] 00110
17 sshbuf_check_sanity [function] [call site] 00111
16 sshbuf_maybe_pack [function] [call site] 00112
16 recallocarray [function] [call site] 00113
17 calloc [call site] 00114
17 __errno_location [call site] 00115
17 __errno_location [call site] 00116
17 getpagesize [call site] 00117
17 memset [call site] 00118
17 memset [call site] 00119
17 explicit_bzero [call site] 00120
16 sshbuf_check_reserve [function] [call site] 00121
12 sshkey_impl_from_type [function] [call site] 00122
12 sshkey_ssh_name_from_type_nid [function] [call site] 00123
13 sshkey_impl_from_type_nid [function] [call site] 00124
12 sshbuf_put_cstring [function] [call site] 00125
13 strlen [call site] 00126
13 sshbuf_put_string [function] [call site] 00127
14 sshbuf_reserve [function] [call site] 00128
10 ssh_err [function] [call site] 00129
11 ssherr_libcrypto [function] [call site] 00130
12 OPENSSL_init_crypto [call site] 00131
12 ERR_get_error_line_data [call site] 00132
12 ERR_error_string_n [call site] 00133
12 snprintf [call site] 00134
12 sshlog [function] [call site] 00135
12 ERR_reason_error_string [call site] 00136
12 snprintf [call site] 00137
11 __errno_location [call site] 00138
11 strerror [call site] 00139
10 sshfatal [function] [call site] 00140
10 sshbuf_equals [function] [call site] 00141
11 sshbuf_ptr [function] [call site] 00142
11 sshbuf_len [function] [call site] 00143
11 sshbuf_len [function] [call site] 00144
11 sshbuf_ptr [function] [call site] 00145
11 sshbuf_len [function] [call site] 00146
11 memcmp [call site] 00147
10 sshbuf_free [function] [call site] 00148
10 sshbuf_free [function] [call site] 00149
9 sshkey_type [function] [call site] 00150
9 sshfatal [function] [call site] 00151
9 sshbuf_new [function] [call site] 00152
9 sshfatal [function] [call site] 00153
9 sshkey_putb [function] [call site] 00154
9 ssh_err [function] [call site] 00155
9 sshfatal [function] [call site] 00156
9 sshbuf_equals [function] [call site] 00157
9 sshfatal [function] [call site] 00158
9 xrecallocarray [function] [call site] 00159
10 recallocarray [function] [call site] 00160
10 sshfatal [function] [call site] 00161
9 helper_terminate [function] [call site] 00162
10 sshfatal [function] [call site] 00163
10 sshlog [function] [call site] 00164
10 close [call site] 00165
10 sshfatal [function] [call site] 00166
10 xrecallocarray [function] [call site] 00167
10 sshbuf_free [function] [call site] 00168
8 sshkey_impl_from_type [function] [call site] 00169
8 sshkey_is_cert [function] [call site] 00170
8 cert_free [function] [call site] 00171
9 freezero [function] [call site] 00172
8 freezero [function] [call site] 00173
8 sshkey_prekey_free [function] [call site] 00174
9 munmap [call site] 00175
7 freezero [function] [call site] 00176
4 sshkey_free [function] [call site] 00177
3 abort [call site] 00178
3 strdup [call site] 00179
3 abort [call site] 00180
3 sshkey_read [function] [call site] 00181
4 sshkey_impl_from_type [function] [call site] 00182
4 strcspn [call site] 00183
4 strlen [call site] 00184
4 peek_type_nid [function] [call site] 00185
5 strlen [call site] 00186
5 memcmp [call site] 00187
5 key_type_is_ecdsa_variant [function] [call site] 00188
4 sshbuf_new [function] [call site] 00189
4 strcspn [call site] 00190
4 strndup [call site] 00191
4 sshbuf_free [function] [call site] 00192
4 sshbuf_b64tod [function] [call site] 00193
5 strlen [call site] 00194
5 __b64_pton [function] [call site] 00195
6 __ctype_b_loc [call site] 00196
6 strchr [call site] 00197
6 __ctype_b_loc [call site] 00198
6 __ctype_b_loc [call site] 00199
5 freezero [function] [call site] 00200
5 sshbuf_put [function] [call site] 00201
5 freezero [function] [call site] 00202
5 freezero [function] [call site] 00203
4 sshbuf_free [function] [call site] 00204
4 sshkey_fromb [function] [call site] 00205
5 sshkey_from_blob_internal [function] [call site] 00206
6 sshbuf_fromb [function] [call site] 00207
7 sshbuf_check_sanity [function] [call site] 00208
7 sshbuf_ptr [function] [call site] 00209
7 sshbuf_len [function] [call site] 00210
7 sshbuf_from [function] [call site] 00211
8 calloc [call site] 00212
7 sshbuf_set_parent [function] [call site] 00213
8 sshbuf_check_sanity [function] [call site] 00214
8 sshbuf_check_sanity [function] [call site] 00215
7 sshbuf_free [function] [call site] 00216
6 sshbuf_get_cstring [function] [call site] 00217
7 sshbuf_peek_string_direct [function] [call site] 00218
8 sshbuf_ptr [function] [call site] 00219
8 sshbuf_len [function] [call site] 00220
8 sshbuf_len [function] [call site] 00221
7 memchr [call site] 00222
7 sshbuf_get_string_direct [function] [call site] 00223
8 sshbuf_peek_string_direct [function] [call site] 00224
8 sshbuf_consume [function] [call site] 00225
9 sshbuf_check_sanity [function] [call site] 00226
9 sshbuf_len [function] [call site] 00227
6 sshkey_type_from_name [function] [call site] 00228
7 type_from_name [function] [call site] 00229
8 strcmp [call site] 00230
8 strcasecmp [call site] 00231
6 sshkey_type_is_cert [function] [call site] 00232
6 sshkey_match_keyname_to_sigalgs [function] [call site] 00233
7 sshkey_type_from_name [function] [call site] 00234
7 match_pattern_list [function] [call site] 00235
7 match_pattern_list [function] [call site] 00236
7 match_pattern_list [function] [call site] 00237
7 match_pattern_list [function] [call site] 00238
7 match_pattern_list [function] [call site] 00239
7 match_pattern_list [function] [call site] 00240
7 match_pattern_list [function] [call site] 00241
7 match_pattern_list [function] [call site] 00242
7 match_pattern_list [function] [call site] 00243
7 match_pattern_list [function] [call site] 00244
7 match_pattern_list [function] [call site] 00245
6 sshkey_impl_from_type [function] [call site] 00246
6 sshkey_new [function] [call site] 00247
6 sshkey_type_is_cert [function] [call site] 00248
6 sshbuf_get_string_direct [function] [call site] 00249
6 sshkey_is_cert [function] [call site] 00250
6 cert_parse [function] [call site] 00251
7 sshbuf_putb [function] [call site] 00252
7 sshbuf_get_u64 [function] [call site] 00253
8 sshbuf_ptr [function] [call site] 00254
8 sshbuf_consume [function] [call site] 00255
7 sshbuf_get_u32 [function] [call site] 00256
8 sshbuf_ptr [function] [call site] 00257
8 sshbuf_consume [function] [call site] 00258
7 sshbuf_get_cstring [function] [call site] 00259
7 sshbuf_froms [function] [call site] 00260
8 sshbuf_peek_string_direct [function] [call site] 00261
8 sshbuf_from [function] [call site] 00262
8 sshbuf_consume [function] [call site] 00263
8 sshbuf_set_parent [function] [call site] 00264
8 sshbuf_free [function] [call site] 00265
7 sshbuf_get_u64 [function] [call site] 00266
7 sshbuf_get_u64 [function] [call site] 00267
7 sshbuf_froms [function] [call site] 00268
7 sshbuf_froms [function] [call site] 00269
7 sshbuf_get_string_direct [function] [call site] 00270
7 sshbuf_froms [function] [call site] 00271
7 sshbuf_len [function] [call site] 00272
7 sshbuf_get_string [function] [call site] 00273
8 sshbuf_get_string_direct [function] [call site] 00274
7 sshkey_get_sigtype [function] [call site] 00275
8 sshbuf_from [function] [call site] 00276
8 sshbuf_get_cstring [function] [call site] 00277
8 sshbuf_free [function] [call site] 00278
7 match_pattern_list [function] [call site] 00279
7 sshkey_from_blob_internal [function] [call site] 00280
8 sshbuf_len [function] [call site] 00281
8 sshbuf_free [function] [call site] 00282
8 sshkey_free [function] [call site] 00283
7 sshkey_type_is_valid_ca [function] [call site] 00284
8 sshkey_impl_from_type [function] [call site] 00285
7 sshbuf_len [function] [call site] 00286
7 sshbuf_get_cstring [function] [call site] 00287
7 recallocarray [function] [call site] 00288
7 sshbuf_putb [function] [call site] 00289
7 sshbuf_putb [function] [call site] 00290
7 sshbuf_len [function] [call site] 00291
7 sshbuf_get_string_direct [function] [call site] 00292
7 sshbuf_get_string_direct [function] [call site] 00293
7 sshbuf_reset [function] [call site] 00294
8 sshbuf_check_sanity [function] [call site] 00295
8 recallocarray [function] [call site] 00296
8 explicit_bzero [call site] 00297
7 sshbuf_len [function] [call site] 00298
7 sshbuf_get_string_direct [function] [call site] 00299
7 sshbuf_get_string_direct [function] [call site] 00300
7 sshbuf_reset [function] [call site] 00301
7 sshbuf_ptr [function] [call site] 00302
7 sshkey_verify [function] [call site] 00303
8 sshkey_impl_from_key [function] [call site] 00304
7 sshbuf_free [function] [call site] 00305
7 sshbuf_free [function] [call site] 00306
7 sshbuf_free [function] [call site] 00307
7 sshbuf_free [function] [call site] 00308
4 sshbuf_free [function] [call site] 00309
4 sshbuf_free [function] [call site] 00310
4 sshkey_free [function] [call site] 00311
4 key_type_is_ecdsa_variant [function] [call site] 00312
4 sshkey_free [function] [call site] 00313
4 sshkey_free_contents [function] [call site] 00314
4 freezero [function] [call site] 00315
3 abort [call site] 00316
2 load_pubkey_or_die(char const*) [function] [call site] 00317
2 load_pubkey_or_die(char const*) [function] [call site] 00318
1 run_one(int, sshkey*, int, unsigned char const*, unsigned long) [function] [call site] 00319
2 socketpair [call site] 00320
2 write [call site] 00321
2 write [call site] 00322
2 fuzz_arena_begin [function] [call site] 00323
2 ssh_fetch_identitylist [function] [call site] 00324
3 sshbuf_new [function] [call site] 00325
3 sshbuf_put_u8 [function] [call site] 00326
4 sshbuf_reserve [function] [call site] 00327
3 ssh_request_reply [function] [call site] 00328
4 sshbuf_len [function] [call site] 00329
4 atomicio [function] [call site] 00330
5 atomicio6 [function] [call site] 00331
6 __errno_location [call site] 00332
6 __errno_location [call site] 00333
6 __errno_location [call site] 00334
6 poll [call site] 00335
6 __errno_location [call site] 00336
6 __errno_location [call site] 00337
4 write [call site] 00338
4 sshbuf_mutable_ptr [function] [call site] 00339
5 sshbuf_check_sanity [function] [call site] 00340
4 sshbuf_len [function] [call site] 00341
4 atomicio [function] [call site] 00342
4 write [call site] 00343
4 atomicio [function] [call site] 00344
4 read [call site] 00345
4 sshbuf_reset [function] [call site] 00346
4 atomicio [function] [call site] 00347
4 read [call site] 00348
4 sshbuf_put [function] [call site] 00349
3 sshbuf_get_u8 [function] [call site] 00350
4 sshbuf_ptr [function] [call site] 00351
4 sshbuf_consume [function] [call site] 00352
3 sshbuf_get_u32 [function] [call site] 00353
3 calloc [call site] 00354
3 calloc [call site] 00355
3 calloc [call site] 00356
3 deserialise_identity2 [function] [call site] 00357
4 sshbuf_get_string_direct [function] [call site] 00358
4 sshbuf_get_cstring [function] [call site] 00359
4 sshkey_from_blob [function] [call site] 00360
5 sshbuf_from [function] [call site] 00361
5 sshkey_from_blob_internal [function] [call site] 00362
5 sshbuf_free [function] [call site] 00363
3 sshbuf_free [function] [call site] 00364
3 ssh_free_identitylist [function] [call site] 00365
4 sshkey_free [function] [call site] 00366
2 ssh_free_identitylist [function] [call site] 00367
2 ssh_agent_sign [function] [call site] 00368
3 sshbuf_new [function] [call site] 00369
3 agent_encode_alg [function] [call site] 00370
4 sshkey_type_plain [function] [call site] 00371
4 strcmp [call site] 00372
4 strcmp [call site] 00373
4 strcmp [call site] 00374
4 strcmp [call site] 00375
3 sshbuf_put_u8 [function] [call site] 00376
3 sshkey_puts [function] [call site] 00377
4 sshkey_puts_opts_internal [function] [call site] 00378
5 sshbuf_new [function] [call site] 00379
5 to_blob_buf [function] [call site] 00380
5 sshbuf_put_stringb [function] [call site] 00381
6 sshbuf_put_string [function] [call site] 00382
6 sshbuf_ptr [function] [call site] 00383
6 sshbuf_len [function] [call site] 00384
6 sshbuf_put_string [function] [call site] 00385
5 sshbuf_free [function] [call site] 00386
3 sshbuf_put_string [function] [call site] 00387
3 sshbuf_put_u32 [function] [call site] 00388
4 sshbuf_reserve [function] [call site] 00389
3 ssh_request_reply [function] [call site] 00390
3 sshbuf_get_u8 [function] [call site] 00391
3 sshbuf_get_string [function] [call site] 00392
3 sshkey_is_sk [function] [call site] 00393
4 sshkey_type_plain [function] [call site] 00394
3 sshkey_check_sigtype [function] [call site] 00395
4 sshkey_sigalg_by_name [function] [call site] 00396
5 strcmp [call site] 00397
5 sshkey_type_plain [function] [call site] 00398
5 sshkey_ssh_name_from_type_nid [function] [call site] 00399
4 sshkey_get_sigtype [function] [call site] 00400
4 strcmp [call site] 00401
3 freezero [function] [call site] 00402
3 sshbuf_free [function] [call site] 00403
2 ssh_agent_has_key [function] [call site] 00404
3 ssh_fetch_identitylist [function] [call site] 00405
3 sshkey_equal_public [function] [call site] 00406
4 sshkey_type_plain [function] [call site] 00407
4 sshkey_impl_from_type [function] [call site] 00408
3 ssh_free_identitylist [function] [call site] 00409
2 ssh_agent_query_extensions [function] [call site] 00410
3 sshbuf_new [function] [call site] 00411
3 sshbuf_put_u8 [function] [call site] 00412
3 sshbuf_put_cstring [function] [call site] 00413
3 ssh_request_reply [function] [call site] 00414
3 sshbuf_get_u8 [function] [call site] 00415
3 sshbuf_get_cstring [function] [call site] 00416
3 strcmp [call site] 00417
3 xcalloc [function] [call site] 00418
3 sshbuf_len [function] [call site] 00419
3 xrecallocarray [function] [call site] 00420
3 sshbuf_get_cstring [function] [call site] 00421
3 stringlist_free [function] [call site] 00422
3 sshbuf_free [function] [call site] 00423
2 ssh_lock_agent [function] [call site] 00424
3 sshbuf_new [function] [call site] 00425
3 sshbuf_put_u8 [function] [call site] 00426
3 sshbuf_put_cstring [function] [call site] 00427
3 ssh_request_reply_decode [function] [call site] 00428
4 sshbuf_new [function] [call site] 00429
4 ssh_request_reply [function] [call site] 00430
4 sshbuf_get_u8 [function] [call site] 00431
4 decode_reply [function] [call site] 00432
4 sshbuf_free [function] [call site] 00433
3 sshbuf_free [function] [call site] 00434
2 fuzz_arena_cleanup [function] [call site] 00435
3 __real_free [call site] 00436
3 __real_free [call site] 00437
2 close [call site] 00438
2 close [call site] 00439
1 run_one(int, sshkey*, int, unsigned char const*, unsigned long) [function] [call site] 00440
1 run_one(int, sshkey*, int, unsigned char const*, unsigned long) [function] [call site] 00441
1 run_one(int, sshkey*, int, unsigned char const*, unsigned long) [function] [call site] 00442
1 run_one(int, sshkey*, int, unsigned char const*, unsigned long) [function] [call site] 00443
1 run_one(int, sshkey*, int, unsigned char const*, unsigned long) [function] [call site] 00444
1 run_one(int, sshkey*, int, unsigned char const*, unsigned long) [function] [call site] 00445