Fuzz introspector: sftp_client_fuzz
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
45 520 sftp_statvfs call site: 00520 get_decode_statvfs
24 216 sshbuf_get_string call site: 00216 ssh_err
24 450 sftp_lsreaddir call site: 00450 mprintf
14 127 sftpio call site: 00127 bandwidth_limit
12 93 sshbuf_put_u32 call site: 00093 ssh_err
10 257 get_msg call site: 00257 sshbuf_get_u8
10 269 sshbuf_get_u64 call site: 00269 sshbuf_get_u64
9 340 sftp_realpath_expand call site: 00340 sshbuf_put_cstring
9 476 sftp_lsreaddir call site: 00476 xreallocarray
9 584 encode_attrib call site: 00584 sshbuf_put_u64
8 22 sshlogv call site: 00022 match_pattern_list
8 71 sshbuf_check_reserve call site: 00071 ssh_signal

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 log_init [function] [call site] 00001
2 log_change_level [function] [call site] 00002
2 fprintf [call site] 00003
2 exit [call site] 00004
2 fprintf [call site] 00005
2 exit [call site] 00006
2 openlog [call site] 00007
2 closelog [call site] 00008
1 run_one(int, unsigned char const*, unsigned long) [function] [call site] 00009
2 socketpair [call site] 00010
2 write [call site] 00011
2 write [call site] 00012
2 shutdown [call site] 00013
2 fuzz_arena_begin [function] [call site] 00014
2 _setjmp [call site] 00015
2 sftp_init [function] [call site] 00016
3 xcalloc [function] [call site] 00017
4 sshfatal [function] [call site] 00018
5 sshlogv [function] [call site] 00019
6 strrchr [call site] 00020
6 getpid [call site] 00021
6 snprintf [call site] 00022
6 match_pattern_list [function] [call site] 00023
7 strlen [call site] 00024
7 __ctype_b_loc [call site] 00025
7 tolower [call site] 00026
7 match_pattern [function] [call site] 00027
8 strlen [call site] 00028
8 xcalloc [function] [call site] 00029
9 sshfatal [function] [call site] 00030
10 cleanup_exit [function] [call site] 00031
11 longjmp [call site] 00032
11 _exit [call site] 00033
9 calloc [call site] 00034
8 epsilon_closure [function] [call site] 00037
8 memset [call site] 00038
8 epsilon_closure [function] [call site] 00039
6 snprintf [call site] 00040
6 snprintf [call site] 00041
6 do_log [function] [call site] 00043
7 __errno_location [call site] 00044
7 snprintf [call site] 00045
7 vsnprintf [call site] 00046
7 vsnprintf [call site] 00047
7 snprintf [call site] 00048
7 strnvis [function] [call site] 00050
8 __ctype_b_loc [call site] 00051
8 vis [function] [call site] 00052
9 __ctype_b_loc [call site] 00053
9 __ctype_b_loc [call site] 00054
7 snprintf [call site] 00056
7 strlen [call site] 00057
7 write [call site] 00058
7 openlog [call site] 00059
7 syslog [call site] 00060
7 closelog [call site] 00061
7 __errno_location [call site] 00062
3 sshbuf_new [function] [call site] 00063
4 calloc [call site] 00064
4 calloc [call site] 00065
3 sshbuf_put_u8 [function] [call site] 00067
4 sshbuf_reserve [function] [call site] 00068
5 sshbuf_allocate [function] [call site] 00069
6 sshbuf_check_reserve [function] [call site] 00070
7 sshbuf_check_sanity [function] [call site] 00071
8 ssh_signal [function] [call site] 00072
9 memset [call site] 00073
9 sigfillset [call site] 00074
9 sigaction [call site] 00075
9 strsignal [call site] 00076
9 __errno_location [call site] 00077
9 strerror [call site] 00078
8 raise [call site] 00081
6 sshbuf_maybe_pack [function] [call site] 00082
6 recallocarray [function] [call site] 00083
7 calloc [call site] 00084
7 __errno_location [call site] 00085
7 __errno_location [call site] 00086
7 getpagesize [call site] 00087
7 memset [call site] 00088
7 memset [call site] 00089
7 explicit_bzero [call site] 00090
6 sshbuf_check_reserve [function] [call site] 00091
3 sshbuf_put_u32 [function] [call site] 00092
4 sshbuf_reserve [function] [call site] 00093
3 ssh_err [function] [call site] 00094
4 ssherr_libcrypto [function] [call site] 00095
5 OPENSSL_init_crypto [call site] 00096
5 ERR_get_error_line_data [call site] 00097
5 ERR_error_string_n [call site] 00098
5 snprintf [call site] 00099
5 ERR_reason_error_string [call site] 00101
5 snprintf [call site] 00102
4 __errno_location [call site] 00103
4 strerror [call site] 00104
3 send_msg [function] [call site] 00106
4 sshbuf_len [function] [call site] 00107
5 sshbuf_check_sanity [function] [call site] 00108
4 sshbuf_len [function] [call site] 00109
4 sshbuf_len [function] [call site] 00111
4 sshbuf_ptr [function] [call site] 00113
5 sshbuf_check_sanity [function] [call site] 00114
4 sshbuf_len [function] [call site] 00115
4 atomiciov6 [function] [call site] 00116
5 __errno_location [call site] 00117
5 __errno_location [call site] 00118
5 __errno_location [call site] 00119
5 __errno_location [call site] 00120
5 poll [call site] 00121
5 __errno_location [call site] 00122
5 __errno_location [call site] 00123
5 __errno_location [call site] 00124
4 writev [call site] 00125
4 sftpio [function] [call site] 00126
5 refresh_progress_meter [function] [call site] 00127
5 bandwidth_limit [function] [call site] 00128
6 monotime_tv [function] [call site] 00129
7 monotime_ts [function] [call site] 00130
8 clock_gettime [call site] 00131
8 clock_gettime [call site] 00132
8 clock_gettime [call site] 00133
8 __errno_location [call site] 00134
8 strerror [call site] 00135
8 gettimeofday [call site] 00137
6 monotime_tv [function] [call site] 00138
6 nanosleep [call site] 00139
6 __errno_location [call site] 00140
6 monotime_tv [function] [call site] 00141
4 sshbuf_len [function] [call site] 00142
4 __errno_location [call site] 00143
4 strerror [call site] 00144
4 sshbuf_reset [function] [call site] 00146
5 sshbuf_check_sanity [function] [call site] 00147
5 recallocarray [function] [call site] 00148
5 explicit_bzero [call site] 00149
3 get_msg_extended [function] [call site] 00150
4 sshbuf_reset [function] [call site] 00151
4 sshbuf_reserve [function] [call site] 00152
4 atomicio6 [function] [call site] 00155
5 __errno_location [call site] 00156
5 __errno_location [call site] 00157
5 __errno_location [call site] 00158
5 poll [call site] 00159
5 __errno_location [call site] 00160
5 __errno_location [call site] 00161
4 read [call site] 00162
4 __errno_location [call site] 00164
4 __errno_location [call site] 00166
4 strerror [call site] 00167
4 sshbuf_get_u32 [function] [call site] 00169
5 sshbuf_ptr [function] [call site] 00170
5 sshbuf_consume [function] [call site] 00171
6 sshbuf_check_sanity [function] [call site] 00172
6 sshbuf_len [function] [call site] 00173
4 sshbuf_reserve [function] [call site] 00178
4 atomicio6 [function] [call site] 00181
4 read [call site] 00182
4 __errno_location [call site] 00184
4 __errno_location [call site] 00186
4 strerror [call site] 00187
3 sshbuf_get_u8 [function] [call site] 00189
4 sshbuf_ptr [function] [call site] 00190
4 sshbuf_consume [function] [call site] 00191
3 sshbuf_free [function] [call site] 00195
4 sshbuf_check_sanity [function] [call site] 00196
4 sshbuf_free [function] [call site] 00197
5 freezero [function] [call site] 00198
6 explicit_bzero [call site] 00199
3 sshbuf_get_u32 [function] [call site] 00201
3 sshbuf_len [function] [call site] 00205
3 sshbuf_get_cstring [function] [call site] 00206
4 sshbuf_peek_string_direct [function] [call site] 00207
5 sshbuf_ptr [function] [call site] 00208
5 sshbuf_len [function] [call site] 00209
5 sshbuf_len [function] [call site] 00210
4 memchr [call site] 00211
4 sshbuf_get_string_direct [function] [call site] 00212
5 sshbuf_peek_string_direct [function] [call site] 00213
5 sshbuf_consume [function] [call site] 00214
3 sshbuf_get_string [function] [call site] 00215
4 sshbuf_get_string_direct [function] [call site] 00216
3 strcmp [call site] 00219
3 strcmp [call site] 00220
3 strcmp [call site] 00221
3 strcmp [call site] 00222
3 strcmp [call site] 00223
3 strcmp [call site] 00224
3 strcmp [call site] 00225
3 strcmp [call site] 00226
3 strcmp [call site] 00227
3 strcmp [call site] 00228
3 strcmp [call site] 00229
3 strcmp [call site] 00230
3 strcmp [call site] 00231
3 strcmp [call site] 00232
3 strcmp [call site] 00233
3 strcmp [call site] 00234
3 strcmp [call site] 00235
3 strcmp [call site] 00236
3 strcmp [call site] 00237
3 strcmp [call site] 00238
3 sshbuf_free [function] [call site] 00241
3 sftp_get_limits [function] [call site] 00242
4 sshbuf_new [function] [call site] 00244
4 sshbuf_put_u8 [function] [call site] 00246
4 sshbuf_put_u32 [function] [call site] 00247
4 sshbuf_put_cstring [function] [call site] 00248
5 strlen [call site] 00249
5 sshbuf_put_string [function] [call site] 00250
6 sshbuf_reserve [function] [call site] 00251
4 get_msg [function] [call site] 00256
5 get_msg_extended [function] [call site] 00257
4 sshbuf_get_u8 [function] [call site] 00258
4 sshbuf_get_u32 [function] [call site] 00259
4 sshbuf_free [function] [call site] 00265
4 memset [call site] 00266
4 sshbuf_get_u64 [function] [call site] 00267
5 sshbuf_ptr [function] [call site] 00268
5 sshbuf_consume [function] [call site] 00269
4 sshbuf_get_u64 [function] [call site] 00270
4 sshbuf_get_u64 [function] [call site] 00271
4 sshbuf_get_u64 [function] [call site] 00272
4 sshbuf_free [function] [call site] 00275
3 bandwidth_limit_init [function] [call site] 00278
3 bandwidth_limit_init [function] [call site] 00279
2 attrib_clear [function] [call site] 00280
2 sftp_stat [function] [call site] 00281
3 strlen [call site] 00283
3 send_string_request [function] [call site] 00284
4 sshbuf_new [function] [call site] 00285
4 sshbuf_put_u8 [function] [call site] 00287
4 sshbuf_put_u32 [function] [call site] 00288
4 sshbuf_put_string [function] [call site] 00289
4 sshbuf_free [function] [call site] 00294
3 get_decode_stat [function] [call site] 00295
4 memset [call site] 00296
4 sshbuf_new [function] [call site] 00297
4 sshbuf_get_u8 [function] [call site] 00300
4 sshbuf_get_u32 [function] [call site] 00301
4 sshbuf_get_u32 [function] [call site] 00305
4 sshbuf_free [function] [call site] 00312
4 decode_attrib [function] [call site] 00314
5 attrib_clear [function] [call site] 00315
5 sshbuf_get_u32 [function] [call site] 00316
5 sshbuf_get_u64 [function] [call site] 00317
5 sshbuf_get_u32 [function] [call site] 00318
5 sshbuf_get_u32 [function] [call site] 00319
5 sshbuf_get_u32 [function] [call site] 00320
5 sshbuf_get_u32 [function] [call site] 00321
5 sshbuf_get_u32 [function] [call site] 00322
5 sshbuf_get_u32 [function] [call site] 00323
5 sshbuf_get_cstring [function] [call site] 00324
5 sshbuf_get_string [function] [call site] 00325
4 sshbuf_free [function] [call site] 00329
4 sshbuf_free [function] [call site] 00331
2 sftp_lstat [function] [call site] 00332
3 sftp_stat [function] [call site] 00334
3 strlen [call site] 00335
3 send_string_request [function] [call site] 00336
3 get_decode_stat [function] [call site] 00337
2 sftp_realpath [function] [call site] 00338
3 sftp_realpath_expand [function] [call site] 00339
4 sshbuf_new [function] [call site] 00340
4 sshbuf_put_u8 [function] [call site] 00343
4 sshbuf_put_u32 [function] [call site] 00344
4 sshbuf_put_cstring [function] [call site] 00345
4 sshbuf_put_cstring [function] [call site] 00346
4 strlen [call site] 00351
4 send_string_request [function] [call site] 00352
4 sshbuf_get_u8 [function] [call site] 00354
4 sshbuf_get_u32 [function] [call site] 00355
4 sshbuf_get_u32 [function] [call site] 00359
4 sshbuf_get_cstring [function] [call site] 00360
4 sshbuf_free [function] [call site] 00365
4 sshbuf_get_u32 [function] [call site] 00367
4 sshbuf_get_cstring [function] [call site] 00371
4 sshbuf_get_cstring [function] [call site] 00372
4 decode_attrib [function] [call site] 00373
4 sshbuf_free [function] [call site] 00377
2 sftp_expand_path [function] [call site] 00378
3 sftp_can_expand_path [function] [call site] 00379
3 sftp_realpath_expand [function] [call site] 00381
3 sftp_realpath_expand [function] [call site] 00382
2 sftp_readdir [function] [call site] 00383
3 sftp_lsreaddir [function] [call site] 00384
4 sshbuf_new [function] [call site] 00385
4 sshbuf_put_u8 [function] [call site] 00387
4 sshbuf_put_u32 [function] [call site] 00388
4 sshbuf_put_cstring [function] [call site] 00389
4 get_handle [function] [call site] 00393
5 vsnprintf [call site] 00394
5 sshbuf_new [function] [call site] 00395
5 sshbuf_get_u8 [function] [call site] 00398
5 sshbuf_get_u32 [function] [call site] 00399
5 sshbuf_get_u32 [function] [call site] 00403
5 sshbuf_free [function] [call site] 00408
5 sshbuf_get_string [function] [call site] 00410
5 sshbuf_free [function] [call site] 00413
4 sshbuf_free [function] [call site] 00414
4 sshbuf_reset [function] [call site] 00417
4 sshbuf_put_u8 [function] [call site] 00418
4 sshbuf_put_u32 [function] [call site] 00419
4 sshbuf_put_string [function] [call site] 00420
4 sshbuf_reset [function] [call site] 00424
4 sshbuf_get_u8 [function] [call site] 00426
4 sshbuf_get_u32 [function] [call site] 00427
4 sshbuf_get_u32 [function] [call site] 00432
4 sshbuf_get_u32 [function] [call site] 00439
4 sshbuf_get_cstring [function] [call site] 00444
4 sshbuf_get_cstring [function] [call site] 00445
4 decode_attrib [function] [call site] 00448
4 mprintf [function] [call site] 00451
5 vfmprintf [function] [call site] 00452
6 vasnmprintf [function] [call site] 00453
7 vasprintf [call site] 00454
7 strlen [call site] 00455
7 __ctype_get_mb_cur_max [call site] 00456
7 mbtowc [call site] 00457
7 __ctype_get_mb_cur_max [call site] 00458
7 mbtowc [call site] 00459
7 dangerous_locale [function] [call site] 00460
8 nl_langinfo [call site] 00461
8 strcmp [call site] 00462
8 strcmp [call site] 00463
8 strcmp [call site] 00464
8 strcmp [call site] 00465
8 strcmp [call site] 00466
8 strcmp [call site] 00467
7 wcwidth [call site] 00468
7 dangerous_locale [function] [call site] 00469
7 grow_dst [function] [call site] 00470
8 recallocarray [function] [call site] 00471
6 fputs [call site] 00474
4 strpbrk [call site] 00475
4 xreallocarray [function] [call site] 00477
5 reallocarray [call site] 00478
4 sshbuf_free [function] [call site] 00486
4 sftp_free_dirents [function] [call site] 00515
4 sftp_free_dirents [function] [call site] 00516
2 sftp_free_dirents [function] [call site] 00518
2 sftp_statvfs [function] [call site] 00519
3 sshbuf_new [function] [call site] 00522
3 sshbuf_put_u8 [function] [call site] 00524
3 sshbuf_put_u32 [function] [call site] 00525
3 sshbuf_put_cstring [function] [call site] 00526
3 sshbuf_put_cstring [function] [call site] 00527
3 sshbuf_free [function] [call site] 00531
3 get_decode_statvfs [function] [call site] 00532
4 sshbuf_new [function] [call site] 00533
4 sshbuf_get_u8 [function] [call site] 00536
4 sshbuf_get_u32 [function] [call site] 00537
4 sshbuf_get_u32 [function] [call site] 00542
4 sshbuf_free [function] [call site] 00549
4 memset [call site] 00551
4 sshbuf_get_u64 [function] [call site] 00552
4 sshbuf_get_u64 [function] [call site] 00553
4 sshbuf_get_u64 [function] [call site] 00554
4 sshbuf_get_u64 [function] [call site] 00555
4 sshbuf_get_u64 [function] [call site] 00556
4 sshbuf_get_u64 [function] [call site] 00557
4 sshbuf_get_u64 [function] [call site] 00558
4 sshbuf_get_u64 [function] [call site] 00559
4 sshbuf_get_u64 [function] [call site] 00560
4 sshbuf_get_u64 [function] [call site] 00561
4 sshbuf_get_u64 [function] [call site] 00562
4 sshbuf_free [function] [call site] 00565
2 sftp_get_limits [function] [call site] 00566
2 sftp_rm [function] [call site] 00567
3 strlen [call site] 00569
3 send_string_request [function] [call site] 00570
3 get_status [function] [call site] 00571
2 sftp_mkdir [function] [call site] 00574
3 strlen [call site] 00576
3 send_string_attrs_request [function] [call site] 00577
4 sshbuf_new [function] [call site] 00578
4 sshbuf_put_u8 [function] [call site] 00580
4 sshbuf_put_u32 [function] [call site] 00581
4 sshbuf_put_string [function] [call site] 00582
4 encode_attrib [function] [call site] 00583
5 sshbuf_put_u32 [function] [call site] 00584
5 sshbuf_put_u64 [function] [call site] 00585
6 sshbuf_reserve [function] [call site] 00586
5 sshbuf_put_u32 [function] [call site] 00587
5 sshbuf_put_u32 [function] [call site] 00588
5 sshbuf_put_u32 [function] [call site] 00589
5 sshbuf_put_u32 [function] [call site] 00590
5 sshbuf_put_u32 [function] [call site] 00591
4 sshbuf_free [function] [call site] 00596
3 get_status [function] [call site] 00597
2 sftp_rmdir [function] [call site] 00600
3 strlen [call site] 00602
3 send_string_request [function] [call site] 00603
3 get_status [function] [call site] 00604
2 sftp_rename [function] [call site] 00607
3 sshbuf_new [function] [call site] 00608
3 sshbuf_put_u8 [function] [call site] 00611
3 sshbuf_put_u32 [function] [call site] 00612
3 sshbuf_put_cstring [function] [call site] 00613
3 sshbuf_put_u8 [function] [call site] 00617
3 sshbuf_put_u32 [function] [call site] 00618
3 sshbuf_put_cstring [function] [call site] 00621
3 sshbuf_put_cstring [function] [call site] 00622
3 sshbuf_free [function] [call site] 00627
3 get_status [function] [call site] 00628
2 sftp_symlink [function] [call site] 00631
3 sshbuf_new [function] [call site] 00634
3 sshbuf_put_u8 [function] [call site] 00636
3 sshbuf_put_u32 [function] [call site] 00637
3 sshbuf_put_cstring [function] [call site] 00638
3 sshbuf_put_cstring [function] [call site] 00639
3 sshbuf_free [function] [call site] 00644
3 get_status [function] [call site] 00645
2 fuzz_arena_cleanup [function] [call site] 00650
3 __real_free [call site] 00651
3 __real_free [call site] 00652
2 close [call site] 00653
2 close [call site] 00654