High level conclusions

Fuzzers reach 43.70% of cyclomatic complexity.

Fuzzers reach 34.74% of all functions.

Fuzzer agent_fuzz is blocked:

The runtime code coverage of agent_fuzz covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer sig_fuzz is blocked:

The runtime code coverage of sig_fuzz covers 23.07% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer krl_fuzz is blocked:

The runtime code coverage of krl_fuzz covers 8.482% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1029 / 2962

Cyclomatic complexity statically reachable by fuzzers

8262 / 18903

Runtime code coverage of functions

1269 / 2962

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: authfd_reply_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	179	40.1%
gold	[1:9]	30	6.72%
yellow	[10:29]	6	1.34%
greenyellow	[30:49]	3	0.67%
lawngreen	50+	228	51.1%
All colors	446	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
47	26	sshbuf_free	call site: 00026	ssh_signal
31	128	sshbuf_put_string	call site: 00128	sshkey_putb
13	232	sshkey_from_blob_internal	call site: 00232	sshkey_match_keyname_to_sigalgs
11	283	sshkey_from_blob_internal	call site: 00283	sshbuf_putb
10	88	sshkey_free	call site: 00088	pkcs11_key_free
8	160	xrecallocarray	call site: 00160	helper_terminate
7	297	sshbuf_reset	call site: 00297	sshbuf_get_string_direct
6	74	xcalloc	call site: 00074	sshfatal
6	331	atomicio	call site: 00331	__errno_location
6	395	ssh_agent_sign	call site: 00395	sshkey_get_sigtype
4	3	log_init	call site: 00003	fprintf
4	371	agent_encode_alg	call site: 00371	strcmp

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

68

Reachable functions

157

Percentage of reachable functions covered

56.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/authfd_reply_fuzz.cc	4
log.c	5
sshkey.c	35
sshbuf.c	15
misc.c	2
match.c	3
xmalloc.c	2
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
sshbuf-getput-basic.c	15
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	2
openbsd-compat/base64.c	1
regress/misc/fuzz-harness/fuzz_arena.c	2
authfd.c	11
atomicio.c	2

Fuzzer: krl_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	698	95.7%
gold	[1:9]	13	1.78%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	18	2.46%
All colors	729	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
288	189	ssh_krl_from_blob	call site: 00189	parse_revoked_certs
250	478	LLVMFuzzerTestOneInput	call site: 00478	ssh_krl_from_blob
73	107	sshbuf_ptr	call site: 00107	cert_free
45	37	sshlog	call site: 00037	match_pattern_list
17	86	sshbuf_free	call site: 00086	sshkey_free
9	18	sshkey_is_cert	call site: 00018	cert_new
8	28	sshbuf_free	call site: 00028	ssh_signal
4	2	log_init	call site: 00002	fprintf
2	104	sshbuf_len	call site: 00104	sshbuf_putb
1	14	sshkey_generate	call site: 00014	sshkey_impl_from_type
1	83	sshbuf_free	call site: 00083	freezero

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

205

Reachable functions

224

Percentage of reachable functions covered

8.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/krl_fuzz.cc	1
log.c	5
sshkey.c	44
sshbuf.c	14
misc.c	2
match.c	3
xmalloc.c	4
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
sshbuf-getput-basic.c	18
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	2
krl.c	50
openbsd-compat/timingsafe_bcmp.c	1
bitmap.c	11
utf8.c	4
digest-openssl.c	4
openbsd-compat/strlcat.c	1
openbsd-compat/base64.c	1

Fuzzer: hostfile_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	269	56.8%
gold	[1:9]	4	0.84%
yellow	[10:29]	1	0.21%
greenyellow	[30:49]	1	0.21%
lawngreen	50+	198	41.8%
All colors	473	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
35	371	sshkey_from_blob_internal	call site: 00371	cert_parse
29	187	ssh_digest_bytes	call site: 00187	arc4random_buf
28	31	match_pattern	call site: 00031	sshfatal
27	105	sshbuf_allocate	call site: 00105	sshbuf_put_cstring
25	408	sshkey_from_blob_internal	call site: 00408	sshbuf_putb
20	137	sshbuf_free	call site: 00137	sshkey_putb
13	357	sshkey_from_blob_internal	call site: 00357	sshkey_match_keyname_to_sigalgs
11	77	sshbuf_len	call site: 00077	sshbuf_putb
9	457	record_hostkey	call site: 00457	ssh_err
8	300	sshkey_new	call site: 00300	cert_new
8	434	sshkey_read	call site: 00434	sshkey_free
5	15	sshkey_free	call site: 00015	pkcs11_key_free

Runtime coverage analysis

Covered functions

76

Functions that are reachable but not covered

106

Reachable functions

183

Percentage of reachable functions covered

42.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/hostfile_fuzz.cc	2
log.c	5
hostfile.c	10
sshkey.c	29
ssh-pkcs11-client.c	3
match.c	4
xmalloc.c	6
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
sshbuf.c	14
misc.c	2
sshbuf-getput-basic.c	11
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	2
openbsd-compat/freezero.c	1
digest-openssl.c	9
openbsd-compat/arc4random.c	6
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
openbsd-compat/base64.c	2
hmac.c	6

Fuzzer: authopt_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	64	39.5%
gold	[1:9]	3	1.85%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.23%
lawngreen	50+	93	57.4%
All colors	162	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
52	84	sshauthopt_parse	call site: 00084	a2tun
4	50	recallocarray	call site: 00050	__errno_location
3	152	sshauthopt_merge	call site: 00152	dup_strings
2	156	sshauthopt_merge	call site: 00156	sshauthopt_free
1	77	a2port	call site: 00077	ntohs
1	148	dup_strings	call site: 00148	dup_strings
1	150	sshauthopt_merge	call site: 00150	dup_strings

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

44

Reachable functions

63

Percentage of reachable functions covered

30.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/authopt_fuzz.cc	1
auth-options.c	7
misc.c	8
openbsd-compat/recallocarray.c	1
openbsd-compat/strtonum.c	1
xmalloc.c	3
fatal.c	1
log.c	2
match.c	3
cleanup.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
openbsd-compat/freezero.c	1

Fuzzer: authkeys_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	224	34.1%
gold	[1:9]	63	9.60%
yellow	[10:29]	2	0.30%
greenyellow	[30:49]	7	1.06%
lawngreen	50+	360	54.8%
All colors	656	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
40	121	sshbuf_put_string	call site: 00121	sshkey_putb
21	464	fingerprint_b64	call site: 00464	fingerprint_randomart
18	548	auth_authorise_keyopts	call site: 00548	addr_match_cidr_list
14	589	cert_option_list	call site: 00589	addr_match_cidr_list
13	225	sshkey_from_blob_internal	call site: 00225	sshkey_match_keyname_to_sigalgs
8	19	sshbuf_free	call site: 00019	ssh_signal
8	447	ssh_digest_alg_name	call site: 00447	fingerprint_hex
7	59	do_log	call site: 00059	sshfatal
6	85	sshkey_impl_from_key	call site: 00085	helper_by_key
6	284	cert_parse	call site: 00284	sshbuf_get_string_direct
6	405	xstrdup	call site: 00405	a2tun
5	420	sshkey_equal	call site: 00420	cert_compare

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

80

Reachable functions

203

Percentage of reachable functions covered

60.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/authkeys_fuzz.cc	3
sshkey.c	41
sshbuf.c	14
misc.c	12
log.c	3
match.c	5
xmalloc.c	4
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
sshbuf-getput-basic.c	11
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	2
openbsd-compat/base64.c	2
auth2-pubkeyfile.c	3
authfile.c	1
auth-options.c	9
openbsd-compat/strtonum.c	1
openbsd-compat/timingsafe_bcmp.c	1
digest-openssl.c	4
openbsd-compat/strlcat.c	1
addrmatch.c	2
addr.c	13

Fuzzer: misc_parse_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	113	38.0%
gold	[1:9]	30	10.1%
yellow	[10:29]	17	5.72%
greenyellow	[30:49]	61	20.5%
lawngreen	50+	76	25.5%
All colors	297	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	51	match_pattern	call site: 00051	sshfatal
12	173	argv_assemble	call site: 00173	ssh_err
12	265	addr_match_cidr_list	call site: 00265	sshlog
8	144	sshbuf_reset	call site: 00144	ssh_signal
7	217	parse_absolute_time	call site: 00217	snprintf
6	30	xstrdup	call site: 00030	sshfatal
4	2	log_init	call site: 00002	fprintf
4	41	match_pattern	call site: 00041	sshfatal
4	257	addr_match_list	call site: 00257	addr_netmask
3	155	sshbuf_reset	call site: 00155	calloc
2	80	strtonum	call site: 00080	__errno_location
2	90	parse_uri	call site: 00090	urldecode

Runtime coverage analysis

Covered functions

65

Functions that are reachable but not covered

58

Reachable functions

125

Percentage of reachable functions covered

53.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/misc_parse_fuzz.cc	3
log.c	5
misc.c	19
xmalloc.c	4
fatal.c	1
match.c	6
cleanup.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
openbsd-compat/strtonum.c	1
sshbuf.c	10
openbsd-compat/recallocarray.c	1
sshbuf-getput-basic.c	3
ssherr.c	1
ssherr-libcrypto.c	1
openbsd-compat/freezero.c	1
addr.c	13
addrmatch.c	2

Fuzzer: sftp_client_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	296	45.1%
gold	[1:9]	26	3.96%
yellow	[10:29]	9	1.37%
greenyellow	[30:49]	7	1.06%
lawngreen	50+	317	48.3%
All colors	655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
45	520	sftp_statvfs	call site: 00520	get_decode_statvfs
24	216	sshbuf_get_string	call site: 00216	ssh_err
24	450	sftp_lsreaddir	call site: 00450	mprintf
14	127	sftpio	call site: 00127	bandwidth_limit
12	93	sshbuf_put_u32	call site: 00093	ssh_err
10	257	get_msg	call site: 00257	sshbuf_get_u8
10	269	sshbuf_get_u64	call site: 00269	sshbuf_get_u64
9	340	sftp_realpath_expand	call site: 00340	sshbuf_put_cstring
9	476	sftp_lsreaddir	call site: 00476	xreallocarray
9	584	encode_attrib	call site: 00584	sshbuf_put_u64
8	22	sshlogv	call site: 00022	match_pattern_list
8	71	sshbuf_check_reserve	call site: 00071	ssh_signal

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

70

Reachable functions

145

Percentage of reachable functions covered

51.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/sftp_client_fuzz.cc	4
log.c	5
regress/misc/fuzz-harness/fuzz_arena.c	2
sftp-client.c	29
xmalloc.c	4
fatal.c	1
match.c	3
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
sshbuf.c	11
sshbuf-getput-basic.c	12
misc.c	6
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
atomicio.c	2
openbsd-compat/freezero.c	1
sftp-common.c	4
utf8.c	5

Fuzzer: sshconfig_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	592	59.9%
gold	[1:9]	98	9.92%
yellow	[10:29]	52	5.26%
greenyellow	[30:49]	2	0.20%
lawngreen	50+	243	24.6%
All colors	987	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	576	match_cfg_line	call site: 00576	expand_match_exec_or_include_path
58	697	tohex	call site: 00697	execute_in_shell
23	47	match_pattern	call site: 00047	do_log
22	281	process_config_line_depth	call site: 00281	xstrdup
20	466	parse_forward	call site: 00466	xstrdup
19	785	process_config_line_depth	call site: 00785	a2tun
17	141	scan_scaled	call site: 00141	sshlog
16	325	ssh_digest_bytes	call site: 00325	kex_names_valid
13	311	freezero	call site: 00311	ssh_digest_start
12	425	sshbuf_allocate	call site: 00425	ssh_err
12	940	process_config_line_depth	call site: 00940	sshlog
10	211	parse_uri	call site: 00211	urldecode

Runtime coverage analysis

Covered functions

113

Functions that are reachable but not covered

150

Reachable functions

263

Percentage of reachable functions covered

42.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/sshconfig_fuzz.cc	2
log.c	7
openbsd-compat/mktemp.c	1
readconf.c	26
fatal.c	1
match.c	4
xmalloc.c	7
cleanup.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
misc.c	39
openbsd-compat/fmt_scaled.c	1
openbsd-compat/strtonum.c	1
cipher.c	2
mac.c	3
hmac.c	3
digest-openssl.c	8
openbsd-compat/freezero.c	1
kex-names.c	2
sshkey.c	5
openbsd-compat/recallocarray.c	1
sshbuf.c	9
sshbuf-getput-basic.c	2
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	1
addrmatch.c	1
addr.c	13
openbsd-compat/strlcat.c	1
openbsd-compat/bsd-closefrom.c	2
openbsd-compat/glob.c	20

Fuzzer: sig_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	158	75.2%
gold	[1:9]	8	3.80%
yellow	[10:29]	1	0.47%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	20.4%
All colors	210	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
57	119	sshkey_ssh_name_from_type_nid	call site: 00119	cert_free
45	30	sshlog	call site: 00030	match_pattern_list
18	100	sshbuf_ptr	call site: 00100	sshbuf_put
9	11	sshkey_is_cert	call site: 00011	cert_new
9	87	sshkey_impl_from_key	call site: 00087	helper_by_key
8	21	sshbuf_free	call site: 00021	ssh_signal
7	79	sshbuf_free	call site: 00079	sshkey_free
2	97	sshbuf_len	call site: 00097	sshbuf_putb
1	7	sshkey_generate	call site: 00007	sshkey_impl_from_type
1	76	sshbuf_free	call site: 00076	freezero
1	202	LLVMFuzzerTestOneInput	call site: 00202	sshkey_verify

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

70

Reachable functions

91

Percentage of reachable functions covered

23.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/sig_fuzz.cc	2
sshkey.c	19
sshbuf.c	9
misc.c	1
log.c	3
match.c	3
xmalloc.c	2
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
sshbuf-getput-basic.c	4
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	1

Fuzzer: kex_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	604	37.5%
gold	[1:9]	145	9.01%
yellow	[10:29]	8	0.49%
greenyellow	[30:49]	6	0.37%
lawngreen	50+	846	52.5%
All colors	1609	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
44	739	ssh_remote_ipaddr	call site: 00739	get_peer_ipaddr
28	346	crypto_hash_sha512	call site: 00346	arc4random_buf
25	505	sshkey_parse_private2	call site: 00505	sshkey_parse_private_pem_fileblob
23	1083	ssh_packet_close_internal	call site: 01083	ssh_packet_clear_keys
20	232	ssh_err	call site: 00232	sshkey_putb
19	531	sshkey_check_rsa_length	call site: 00531	sshkey_new
16	273	sshkey_from_blob_internal	call site: 00273	cert_parse
15	575	sshkey_ec_validate_private	call site: 00575	sshkey_new
15	1185	ssh_set_newkeys	call site: 01185	ssh_packet_enable_delayed_compress
14	1112	ssh_packet_write_poll	call site: 01112	sshpkt_fatal
12	914	ssh_packet_send2_wrapped	call site: 00914	compress_buffer
11	299	sshkey_from_blob_internal	call site: 00299	sshbuf_putb

Runtime coverage analysis

Covered functions

766

Functions that are reachable but not covered

186

Reachable functions

478

Percentage of reachable functions covered

61.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/kex_fuzz.cc	13
log.c	6
xmalloc.c	4
fatal.c	1
match.c	6
cleanup.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
sshbuf.c	16
sshkey.c	52
misc.c	11
sshbuf-getput-basic.c	16
openbsd-compat/recallocarray.c	1
sshbuf-misc.c	3
openbsd-compat/base64.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
ssherr.c	1
ssherr-libcrypto.c	1
cipher.c	13
openbsd-compat/bcrypt_pbkdf.c	2
openbsd-compat/../crypto_api.h	1
openbsd-compat/blowfish.c	6
openbsd-compat/arc4random.c	6
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
cipher-chachapoly-libcrypto.c	4
poly1305.c	1
openbsd-compat/timingsafe_bcmp.c	1
ssh-ecdsa.c	1
ssh_api.c	11
entropy.c	1
openbsd-compat/openssl-compat.c	2
packet.c	51
kex.c	22
mac.c	6
umac.c	26
./umac.c	26
hmac.c	6
digest-openssl.c	9
canohost.c	7
kex-names.c	7
openbsd-compat/strlcat.c	1
compat.c	2
dispatch.c	2

Fuzzer: session_channel_req_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1926	67.7%
gold	[1:9]	579	20.3%
yellow	[10:29]	55	1.93%
greenyellow	[30:49]	15	0.52%
lawngreen	50+	269	9.45%
All colors	2844	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
215	2198	session_pty_req	call site: 02198	ssh_packet_disconnect
188	1708	do_exec	call site: 01708	do_exec_pty
188	1897	channel_close_fds	call site: 01897	session_set_fds
133	2535	session_auth_agent_req	call site: 02535	auth_input_request_forwarding
93	1056	ssh_hmac_final	call site: 01056	umac_final
83	671	sshkey_parse_private2	call site: 00671	sshkey_parse_private_pem_fileblob
72	1155	ssh_packet_send2_wrapped	call site: 01155	ssh_packet_disconnect
62	2422	session_x11_req	call site: 02422	session_setup_x11fwd
44	1236	mac_init	call site: 01236	umac_new
40	869	ssh_remote_ipaddr	call site: 00869	get_peer_ipaddr
36	505	private2_decrypt	call site: 00505	bcrypt_pbkdf
31	2499	channel_new	call site: 02499	session_close_single_x11

Runtime coverage analysis

Covered functions

345

Functions that are reachable but not covered

388

Reachable functions

675

Percentage of reachable functions covered

42.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/session_channel_req_fuzz.cc	1
regress/misc/fuzz-harness/session_channel_req_fuzz_helper.c	19
log.c	8
servconf.c	8
xmalloc.c	7
fatal.c	1
match.c	7
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
misc.c	27
openbsd-compat/recallocarray.c	1
cipher.c	14
mac.c	7
kex-names.c	9
sshkey.c	53
openbsd-compat/strlcat.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf.c	17
sshbuf-getput-basic.c	16
sshbuf-misc.c	3
openbsd-compat/base64.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
openbsd-compat/bcrypt_pbkdf.c	2
openbsd-compat/../crypto_api.h	1
openbsd-compat/blowfish.c	6
openbsd-compat/arc4random.c	8
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
cipher-chachapoly-libcrypto.c	4
poly1305.c	1
openbsd-compat/timingsafe_bcmp.c	1
ssh-ecdsa.c	1
ssh_api.c	12
entropy.c	1
openbsd-compat/openssl-compat.c	2
packet.c	63
kex.c	22
umac.c	26
./umac.c	26
hmac.c	6
digest-openssl.c	9
canohost.c	7
compat.c	2
dispatch.c	5
channels.c	26
session.c	41
sshpty.c	2
openbsd-compat/bsd-misc.c	1
openbsd-compat/bsd-closefrom.c	2
openbsd-compat/setproctitle.c	1
ttymodes.c	3
nchan.c	1
misc-agent.c	6
openbsd-compat/arc4random_uniform.c	1

Fuzzer: mux_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	904	56.8%
gold	[1:9]	532	33.4%
yellow	[10:29]	44	2.76%
greenyellow	[30:49]	10	0.62%
lawngreen	50+	101	6.34%
All colors	1591	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
93	925	ssh_hmac_final	call site: 00925	umac_final
83	504	sshkey_parse_private2	call site: 00504	sshkey_parse_private_pem_fileblob
72	1024	ssh_packet_send2_wrapped	call site: 01024	ssh_packet_disconnect
44	704	ssh_remote_ipaddr	call site: 00704	get_peer_ipaddr
44	1105	mac_init	call site: 01105	umac_new
40	220	sshbuf_put_string	call site: 00220	sshkey_putb
36	337	private2_decrypt	call site: 00337	bcrypt_pbkdf
27	1536	channel_new	call site: 01536	channel_set_used_time
19	432	private2_decrypt	call site: 00432	chachapoly_crypt
16	272	sshkey_from_blob_internal	call site: 00272	cert_parse
15	664	ssh_digest_free	call site: 00664	sshkey_free
15	1152	ssh_set_newkeys	call site: 01152	ssh_packet_enable_delayed_compress

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

253

Reachable functions

476

Percentage of reachable functions covered

46.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/mux_fuzz.cc	1
regress/misc/fuzz-harness/mux_fuzz_helper.c	8
log.c	6
sshbuf.c	17
sshkey.c	52
misc.c	13
match.c	6
xmalloc.c	4
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
sshbuf-getput-basic.c	16
openbsd-compat/recallocarray.c	1
sshbuf-misc.c	3
openbsd-compat/base64.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
ssherr.c	1
ssherr-libcrypto.c	1
cipher.c	13
openbsd-compat/bcrypt_pbkdf.c	2
openbsd-compat/../crypto_api.h	1
openbsd-compat/blowfish.c	6
openbsd-compat/arc4random.c	6
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
cipher-chachapoly-libcrypto.c	4
poly1305.c	1
openbsd-compat/timingsafe_bcmp.c	1
ssh-ecdsa.c	1
ssh_api.c	11
entropy.c	1
openbsd-compat/openssl-compat.c	2
packet.c	51
kex.c	22
mac.c	6
umac.c	26
./umac.c	26
hmac.c	6
digest-openssl.c	9
canohost.c	7
kex-names.c	7
openbsd-compat/strlcat.c	1
compat.c	2
dispatch.c	2
channels.c	8

Fuzzer: privkey_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	137	47.5%
gold	[1:9]	1	0.34%
yellow	[10:29]	4	1.38%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	146	50.6%
All colors	288	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
45	16	sshlog	call site: 00016	match_pattern_list
44	167	sshkey_ssh_name_from_type_nid	call site: 00167	sshkey_putb
13	101	sshkey_from_blob_internal	call site: 00101	sshkey_match_keyname_to_sigalgs
10	137	sshkey_impl_from_key	call site: 00137	helper_by_key
8	7	sshbuf_ptr	call site: 00007	ssh_signal
3	133	sshkey_free	call site: 00133	pkcs11_key_free
2	157	recallocarray	call site: 00157	__errno_location
2	164	sshbuf_allocate	call site: 00164	sshkey_ssh_name_from_type_nid
1	73	type_from_name	call site: 00073	strcasecmp
1	84	sshbuf_set_parent	call site: 00084	sshbuf_free
1	97	sshbuf_fromb	call site: 00097	sshbuf_free
1	127	cert_new	call site: 00127	cert_free

Runtime coverage analysis

Covered functions

111

Functions that are reachable but not covered

56

Reachable functions

108

Percentage of reachable functions covered

48.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/privkey_fuzz.cc	1
sshbuf.c	14
sshkey.c	28
sshbuf-getput-basic.c	11
misc.c	1
log.c	3
match.c	3
xmalloc.c	2
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	1

Fuzzer: sshsig_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	143	36.1%
gold	[1:9]	3	0.75%
yellow	[10:29]	7	1.76%
greenyellow	[30:49]	6	1.51%
lawngreen	50+	237	59.8%
All colors	396	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	267	sshkey_ssh_name_from_type_nid	call site: 00267	sshkey_putb
28	35	match_pattern	call site: 00035	sshfatal
13	217	sshkey_type_is_cert	call site: 00217	sshkey_match_keyname_to_sigalgs
10	113	sshsig_peek_hashalg	call site: 00113	ssherr_libcrypto
10	251	sshkey_impl_from_key	call site: 00251	helper_by_key
8	16	sshbuf_fromb	call site: 00016	ssh_signal
6	6	log_init	call site: 00006	fprintf
4	25	sshlog	call site: 00025	match_pattern_list
4	145	hash_buffer	call site: 00145	xstrdup
3	247	sshkey_free	call site: 00247	pkcs11_key_free
2	140	ssh_digest_memory	call site: 00140	ssh_err
2	168	recallocarray	call site: 00168	__errno_location

Runtime coverage analysis

Covered functions

110

Functions that are reachable but not covered

54

Reachable functions

129

Percentage of reachable functions covered

58.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/sshsig_fuzz.cc	1
sshbuf.c	14
log.c	5
sshsig.c	6
misc.c	2
match.c	3
xmalloc.c	4
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
openbsd-compat/freezero.c	1
sshbuf-misc.c	2
openbsd-compat/timingsafe_bcmp.c	1
sshbuf-getput-basic.c	12
ssherr.c	1
ssherr-libcrypto.c	1
digest-openssl.c	5
openbsd-compat/strlcat.c	1
openbsd-compat/recallocarray.c	1
sshkey.c	26
ssh-pkcs11-client.c	3

Fuzzer: sftp_server_msg_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	116	41.1%
gold	[1:9]	17	6.02%
yellow	[10:29]	2	0.70%
greenyellow	[30:49]	1	0.35%
lawngreen	50+	146	51.7%
All colors	282	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	159	xstrdup	call site: 00159	match_list
12	118	sshbuf_consume	call site: 00118	ssh_err
9	73	cleanup_exit	call site: 00073	sshfatal
9	106	handle_to_name	call site: 00106	sshlog
8	27	sshbuf_check_reserve	call site: 00027	ssh_signal
8	39	sshlogv	call site: 00039	match_pattern_list
4	3	log_init	call site: 00003	fprintf
4	98	process	call site: 00098	__orig_sftp_server_cleanup_exit
3	64	strnvis	call site: 00064	snprintf
3	84	sshbuf_allocate	call site: 00084	calloc
3	155	compose_extension	call site: 00155	match_list
3	276	fuzz_server_one	call site: 00276	cleanup_handles

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

56

Reachable functions

113

Percentage of reachable functions covered

50.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/sftp_server_msg_fuzz.cc	1
regress/misc/fuzz-harness/sftp_server_msg_fuzz_helper.c	4
log.c	5
regress/misc/fuzz-harness/fuzz_arena.c	3
sshbuf.c	11
sshbuf-getput-basic.c	11
misc.c	2
match.c	4
xmalloc.c	3
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
openbsd-compat/recallocarray.c	1
regress/misc/fuzz-harness/./../../../sftp-server.c	17
ssherr.c	1
ssherr-libcrypto.c	1
openbsd-compat/freezero.c	1

Fuzzer: agent_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1813	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1813	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1812	0	EP	call site: 00000	test_one

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

410

Reachable functions

410

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/agent_fuzz.cc	1
regress/misc/fuzz-harness/agent_fuzz_helper.c	9
log.c	6
match.c	3
xmalloc.c	6
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
regress/misc/fuzz-harness/./../../../ssh-agent.c	43
misc-agent.c	1
ssh-pkcs11-client.c	13
openbsd-compat/recallocarray.c	1
sshbuf.c	15
misc.c	6
openbsd-compat/freezero.c	1
sshkey.c	78
sshbuf-getput-basic.c	18
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	3
openbsd-compat/base64.c	2
cipher.c	8
openbsd-compat/bcrypt_pbkdf.c	2
openbsd-compat/../crypto_api.h	1
openbsd-compat/blowfish.c	6
openbsd-compat/arc4random.c	6
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
cipher-chachapoly-libcrypto.c	3
poly1305.c	1
openbsd-compat/timingsafe_bcmp.c	1
ssh-ecdsa.c	1
digest-openssl.c	4
openbsd-compat/strlcat.c	1
readpass.c	6
openbsd-compat/readpassphrase.c	2
openbsd-compat/bsd-closefrom.c	2
ssh-sk.c	8
atomicio.c	2

Fuzzer: sshsigopt_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	32	100.%
All colors	32	100

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

9

Reachable functions

16

Percentage of reachable functions covered

43.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/sshsigopt_fuzz.cc	1
sshsig.c	2
misc.c	4

Fuzzer: sshd_auth_session_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1174	58.3%
gold	[1:9]	497	24.7%
yellow	[10:29]	40	1.98%
greenyellow	[30:49]	30	1.49%
lawngreen	50+	271	13.4%
All colors	2012	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
152	1789	auth_log	call site: 01789	sshpkt_send
93	1056	ssh_hmac_final	call site: 01056	umac_final
83	671	sshkey_parse_private2	call site: 00671	sshkey_parse_private_pem_fileblob
72	1155	ssh_packet_send2_wrapped	call site: 01155	ssh_packet_disconnect
44	1236	mac_init	call site: 01236	umac_new
40	869	ssh_remote_ipaddr	call site: 00869	get_peer_ipaddr
36	505	private2_decrypt	call site: 00505	bcrypt_pbkdf
28	400	sshbuf_put_string	call site: 00400	sshkey_putb
20	1767	input_userauth_request	call site: 01767	auth_root_allowed
19	599	private2_decrypt	call site: 00599	chachapoly_crypt
17	1976	ssh_packet_read_poll_seqnr	call site: 01976	sshpkt_start
16	440	sshkey_from_blob_internal	call site: 00440	cert_parse

Runtime coverage analysis

Covered functions

335

Functions that are reachable but not covered

294

Reachable functions

563

Percentage of reachable functions covered

47.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/sshd_auth_session_fuzz.cc	1
regress/misc/fuzz-harness/sshd_auth_session_fuzz_helper.c	13
log.c	6
servconf.c	8
xmalloc.c	6
fatal.c	1
match.c	7
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
misc.c	19
openbsd-compat/recallocarray.c	1
cipher.c	14
mac.c	7
kex-names.c	9
sshkey.c	63
openbsd-compat/strlcat.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf.c	16
sshbuf-getput-basic.c	16
sshbuf-misc.c	5
openbsd-compat/base64.c	2
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
openbsd-compat/bcrypt_pbkdf.c	2
openbsd-compat/../crypto_api.h	1
openbsd-compat/blowfish.c	6
openbsd-compat/arc4random.c	8
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
cipher-chachapoly-libcrypto.c	4
poly1305.c	1
openbsd-compat/timingsafe_bcmp.c	1
ssh-ecdsa.c	1
ssh_api.c	12
entropy.c	1
openbsd-compat/openssl-compat.c	2
packet.c	62
kex.c	23
umac.c	26
./umac.c	26
hmac.c	6
digest-openssl.c	10
canohost.c	7
compat.c	2
dispatch.c	5
regress/misc/fuzz-harness/./../../../auth2.c	17
auth.c	6
openbsd-compat/arc4random_uniform.c	1
openbsd-compat/setproctitle.c	1
auth2-methods.c	1
auth2-chall.c	3

Fuzzer: ssh_channels_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1056	55.2%
gold	[1:9]	479	25.0%
yellow	[10:29]	41	2.14%
greenyellow	[30:49]	11	0.57%
lawngreen	50+	326	17.0%
All colors	1913	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
93	933	ssh_hmac_final	call site: 00933	umac_final
83	512	sshkey_parse_private2	call site: 00512	sshkey_parse_private_pem_fileblob
72	1032	ssh_packet_send2_wrapped	call site: 01032	ssh_packet_disconnect
44	712	ssh_remote_ipaddr	call site: 00712	get_peer_ipaddr
44	1113	mac_init	call site: 01113	umac_new
40	228	sshbuf_put_string	call site: 00228	sshkey_putb
36	345	private2_decrypt	call site: 00345	bcrypt_pbkdf
25	1823	channel_register_fds	call site: 01823	channel_set_used_time
19	440	private2_decrypt	call site: 00440	chachapoly_crypt
16	280	sshkey_from_blob_internal	call site: 00280	cert_parse
16	1694	chan_obuf_empty	call site: 01694	chan_ibuf_empty
16	1878	ssh_packet_read_poll_seqnr	call site: 01878	sshpkt_start

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

270

Reachable functions

545

Percentage of reachable functions covered

50.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/ssh_channels_fuzz.cc	13
log.c	7
sshbuf.c	17
sshkey.c	52
misc.c	13
match.c	6
xmalloc.c	6
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
sshbuf-getput-basic.c	17
openbsd-compat/recallocarray.c	1
sshbuf-misc.c	3
openbsd-compat/base64.c	1
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	3
ssherr.c	1
ssherr-libcrypto.c	1
cipher.c	13
openbsd-compat/bcrypt_pbkdf.c	2
openbsd-compat/../crypto_api.h	1
openbsd-compat/blowfish.c	6
openbsd-compat/arc4random.c	6
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
cipher-chachapoly-libcrypto.c	4
poly1305.c	1
openbsd-compat/timingsafe_bcmp.c	1
ssh-ecdsa.c	1
ssh_api.c	12
entropy.c	1
openbsd-compat/openssl-compat.c	2
packet.c	60
kex.c	22
mac.c	6
umac.c	26
./umac.c	26
hmac.c	6
digest-openssl.c	9
canohost.c	7
kex-names.c	7
openbsd-compat/strlcat.c	1
compat.c	2
dispatch.c	5
channels.c	32
nchan.c	10

Fuzzer: pubkey_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	135	49.2%
gold	[1:9]	1	0.36%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	1.45%
lawngreen	50+	134	48.9%
All colors	274	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
45	15	sshlog	call site: 00015	match_pattern_list
44	157	sshkey_ssh_name_from_type_nid	call site: 00157	sshkey_putb
13	91	sshkey_type_is_cert	call site: 00091	sshkey_match_keyname_to_sigalgs
10	127	sshkey_impl_from_key	call site: 00127	helper_by_key
8	6	sshbuf_fromb	call site: 00006	ssh_signal
3	123	sshkey_free	call site: 00123	pkcs11_key_free
2	147	recallocarray	call site: 00147	__errno_location
2	154	sshbuf_allocate	call site: 00154	sshkey_ssh_name_from_type_nid
1	68	sshbuf_set_parent	call site: 00068	sshbuf_free
1	88	type_from_name	call site: 00088	strcasecmp
1	117	cert_new	call site: 00117	cert_free
1	150	recallocarray	call site: 00150	memset

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

56

Reachable functions

105

Percentage of reachable functions covered

46.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/pubkey_fuzz.cc	1
sshkey.c	25
sshbuf.c	14
misc.c	1
log.c	3
match.c	3
xmalloc.c	2
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
cleanup.c	1
openbsd-compat/freezero.c	1
sshbuf-getput-basic.c	11
ssh-pkcs11-client.c	3
openbsd-compat/recallocarray.c	1
ssherr.c	1
ssherr-libcrypto.c	1
sshbuf-misc.c	1

Fuzzer: ssh_client_session_fuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1590	64.0%
gold	[1:9]	528	21.2%
yellow	[10:29]	51	2.05%
greenyellow	[30:49]	15	0.60%
lawngreen	50+	298	12.0%
All colors	2482	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
174	2126	sshkey_unshield_private	call site: 02126	sshkey_sign
140	1985	sshbuf_put_stringb	call site: 01985	identity_sign
129	1742	fuzz_setup	call site: 01742	sshpkt_send
93	925	ssh_hmac_final	call site: 00925	umac_final
83	504	sshkey_parse_private2	call site: 00504	sshkey_parse_private_pem_fileblob
72	1024	ssh_packet_send2_wrapped	call site: 01024	ssh_packet_disconnect
62	1883	sshkey_fromb_allowlist	call site: 01883	format_identity
47	2304	sshkey_sign	call site: 02304	pkcs11_sign
45	2352	sshkey_sign	call site: 02352	sshpkt_send
44	704	ssh_remote_ipaddr	call site: 00704	get_peer_ipaddr
44	1105	mac_init	call site: 01105	umac_new
40	220	sshbuf_put_string	call site: 00220	sshkey_putb

Runtime coverage analysis

Covered functions

319

Functions that are reachable but not covered

352

Reachable functions

619

Percentage of reachable functions covered

43.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
regress/misc/fuzz-harness/ssh_client_session_fuzz.cc	1
regress/misc/fuzz-harness/ssh_client_session_fuzz_helper.c	9
log.c	6
sshbuf.c	16
sshkey.c	75
misc.c	13
match.c	7
xmalloc.c	6
fatal.c	1
openbsd-compat/strlcpy.c	1
openbsd-compat/vis.c	2
sshbuf-getput-basic.c	17
openbsd-compat/recallocarray.c	1
sshbuf-misc.c	3
openbsd-compat/base64.c	2
openbsd-compat/freezero.c	1
ssh-pkcs11-client.c	6
ssherr.c	1
ssherr-libcrypto.c	1
cipher.c	14
openbsd-compat/bcrypt_pbkdf.c	2
openbsd-compat/../crypto_api.h	1
openbsd-compat/blowfish.c	6
openbsd-compat/arc4random.c	6
openbsd-compat/./arc4random.h	3
openbsd-compat/bsd-getentropy.c	1
openbsd-compat/./chacha_private.h	3
cipher-chachapoly-libcrypto.c	4
poly1305.c	1
openbsd-compat/timingsafe_bcmp.c	1
ssh-ecdsa.c	1
ssh_api.c	12
entropy.c	1
openbsd-compat/openssl-compat.c	2
packet.c	62
kex.c	26
mac.c	7
umac.c	26
./umac.c	26
hmac.c	6
digest-openssl.c	10
canohost.c	7
kex-names.c	9
openbsd-compat/strlcat.c	1
compat.c	2
dispatch.c	6
readconf.c	6
regress/misc/fuzz-harness/./../../../sshconnect2.c	20
authfd.c	12
utf8.c	6
readpass.c	6
openbsd-compat/readpassphrase.c	2
atomicio.c	2
authfile.c	3
sshbuf-io.c	1
sshconnect.c	1
openbsd-compat/bsd-closefrom.c	2
regress/misc/fuzz-harness/ssh-sk-null.cc	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
kex_gen_client	/src/openssh/kexgen.c	1	['N/A']	30	0	145	26	5	938	0	3378	1637
ssh_mldsa44_ed25519_sign	/src/openssh/ssh-mldsa-eddsa.c	9	['N/A', 'N/A', 'N/A', 'N/A', 'size_t', 'N/A', 'N/A', 'N/A', 'int']	21	0	191	35	14	556	0	1684	1001
process_server_config_line_depth	/src/openssh/servconf.c	9	['N/A', 'N/A', 'N/A', 'int', 'N/A', 'N/A', 'N/A', 'int', 'N/A']	12	0	5796	1058	262	224	6	1752	577
verify_host_key_callback	/src/openssh/regress/misc/fuzz-harness/./../../../sshconnect2.c	2	['N/A', 'N/A']	17	0	58	9	2	400	0	2653	547
xxxmain	/src/openssh/regress/misc/fuzz-harness/./../../../ssh-agent.c	2	['int', 'N/A']	28	0	1478	262	61	427	0	2522	325
channel_prepare_poll	/src/openssh/channels.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A']	26	0	193	20	6	332	0	1677	277
srclimit_penalise	/src/openssh/srclimit.c	2	['N/A', 'int']	10	0	481	62	17	78	0	570	267

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2076 / 2962

Cyclomatic complexity statically reachable by fuzzers

12521 / 18903

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

regress/misc/fuzz-harness/authfd_reply_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshbuf_free', 'sshbuf_put_string', 'sshkey_from_blob_internal', 'sshkey_free', 'xrecallocarray', 'sshbuf_reset', 'xcalloc', 'atomicio', 'ssh_agent_sign']

regress/misc/fuzz-harness/krl_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_krl_from_blob', 'LLVMFuzzerTestOneInput', 'sshbuf_ptr', 'sshlog', 'sshbuf_free', 'sshkey_is_cert', 'log_init', 'sshbuf_len', 'sshkey_generate']

regress/misc/fuzz-harness/hostfile_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshkey_from_blob_internal', 'ssh_digest_bytes', 'match_pattern', 'sshbuf_allocate', 'sshbuf_free', 'sshbuf_len', 'record_hostkey', 'sshkey_new']

regress/misc/fuzz-harness/authopt_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshauthopt_parse', 'recallocarray', 'sshauthopt_merge', 'a2port', 'dup_strings']

regress/misc/fuzz-harness/authkeys_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshbuf_put_string', 'fingerprint_b64', 'auth_authorise_keyopts', 'cert_option_list', 'sshkey_from_blob_internal', 'sshbuf_free', 'ssh_digest_alg_name', 'do_log', 'sshkey_impl_from_key', 'cert_parse']

regress/misc/fuzz-harness/misc_parse_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['match_pattern', 'argv_assemble', 'addr_match_cidr_list', 'sshbuf_reset', 'parse_absolute_time', 'xstrdup', 'log_init', 'addr_match_list']

regress/misc/fuzz-harness/sftp_client_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sftp_statvfs', 'sshbuf_get_string', 'sftp_lsreaddir', 'sftpio', 'sshbuf_put_u32', 'get_msg', 'sshbuf_get_u64', 'sftp_realpath_expand', 'encode_attrib']

regress/misc/fuzz-harness/sshconfig_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['match_cfg_line', 'tohex', 'match_pattern', 'process_config_line_depth', 'parse_forward', 'scan_scaled', 'ssh_digest_bytes', 'freezero', 'sshbuf_allocate']

regress/misc/fuzz-harness/sig_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshkey_ssh_name_from_type_nid', 'sshlog', 'sshbuf_ptr', 'sshkey_is_cert', 'sshkey_impl_from_key', 'sshbuf_free', 'sshbuf_len', 'sshkey_generate']

regress/misc/fuzz-harness/kex_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_remote_ipaddr', 'crypto_hash_sha512', 'sshkey_parse_private2', 'ssh_packet_close_internal', 'ssh_err', 'sshkey_check_rsa_length', 'sshkey_from_blob_internal', 'sshkey_ec_validate_private', 'ssh_set_newkeys', 'ssh_packet_write_poll']

regress/misc/fuzz-harness/session_channel_req_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_pty_req', 'do_exec', 'channel_close_fds', 'session_auth_agent_req', 'ssh_hmac_final', 'sshkey_parse_private2', 'ssh_packet_send2_wrapped', 'session_x11_req', 'mac_init', 'ssh_remote_ipaddr']

regress/misc/fuzz-harness/mux_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_hmac_final', 'sshkey_parse_private2', 'ssh_packet_send2_wrapped', 'ssh_remote_ipaddr', 'mac_init', 'sshbuf_put_string', 'private2_decrypt', 'channel_new', 'sshkey_from_blob_internal']

regress/misc/fuzz-harness/privkey_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshlog', 'sshkey_ssh_name_from_type_nid', 'sshkey_from_blob_internal', 'sshkey_impl_from_key', 'sshbuf_ptr', 'sshkey_free', 'recallocarray', 'sshbuf_allocate', 'type_from_name', 'sshbuf_set_parent']

regress/misc/fuzz-harness/sshsig_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshkey_ssh_name_from_type_nid', 'match_pattern', 'sshkey_type_is_cert', 'sshsig_peek_hashalg', 'sshkey_impl_from_key', 'sshbuf_fromb', 'log_init', 'sshlog', 'hash_buffer', 'sshkey_free']

regress/misc/fuzz-harness/sftp_server_msg_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xstrdup', 'sshbuf_consume', 'cleanup_exit', 'handle_to_name', 'sshbuf_check_reserve', 'sshlogv', 'log_init', 'process', 'strnvis', 'sshbuf_allocate']

regress/misc/fuzz-harness/agent_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

regress/misc/fuzz-harness/sshsigopt_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

regress/misc/fuzz-harness/sshd_auth_session_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['auth_log', 'ssh_hmac_final', 'sshkey_parse_private2', 'ssh_packet_send2_wrapped', 'mac_init', 'ssh_remote_ipaddr', 'private2_decrypt', 'sshbuf_put_string', 'input_userauth_request']

regress/misc/fuzz-harness/ssh_channels_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ssh_hmac_final', 'sshkey_parse_private2', 'ssh_packet_send2_wrapped', 'ssh_remote_ipaddr', 'mac_init', 'sshbuf_put_string', 'private2_decrypt', 'channel_register_fds', 'sshkey_from_blob_internal']

regress/misc/fuzz-harness/pubkey_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshlog', 'sshkey_ssh_name_from_type_nid', 'sshkey_type_is_cert', 'sshkey_impl_from_key', 'sshbuf_fromb', 'sshkey_free', 'recallocarray', 'sshbuf_allocate', 'sshbuf_set_parent', 'type_from_name']

regress/misc/fuzz-harness/ssh_client_session_fuzz.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sshkey_unshield_private', 'sshbuf_put_stringb', 'fuzz_setup', 'ssh_hmac_final', 'sshkey_parse_private2', 'ssh_packet_send2_wrapped', 'sshkey_fromb_allowlist', 'sshkey_sign', 'ssh_remote_ipaddr']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
log_init	61	17	27.86%	['misc_parse_fuzz', 'mux_fuzz', 'session_channel_req_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'sshconfig_fuzz', 'ssh_channels_fuzz', 'sftp_client_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'ssh_client_session_fuzz', 'kex_fuzz', 'authfd_reply_fuzz']
sshkey_ec_validate_public	39	15	38.46%	['mux_fuzz', 'pubkey_fuzz', 'agent_fuzz', 'privkey_fuzz', 'sshd_auth_session_fuzz', 'authfd_reply_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz', 'kex_fuzz', 'session_channel_req_fuzz']
crypto_sign_ed25519_keypair	42	21	50.0%	['sig_fuzz', 'krl_fuzz']
ssh_krl_from_blob	98	12	12.24%	['krl_fuzz']
cert_option_list	109	48	44.03%	['authkeys_fuzz']
sshkey_fingerprint	38	17	44.73%	['authkeys_fuzz', 'sshd_auth_session_fuzz', 'krl_fuzz', 'ssh_client_session_fuzz', 'agent_fuzz']
sshkey_cert_check_authority	52	24	46.15%	['authkeys_fuzz', 'agent_fuzz']
addr_match_cidr_list	48	9	18.75%	['misc_parse_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz']
parse_uri	71	35	49.29%	['misc_parse_fuzz', 'sshconfig_fuzz']
atomiciov6	55	29	52.72%	['sftp_client_fuzz']
sftp_init	125	32	25.6%	['sftp_client_fuzz']
sftp_get_limits	41	9	21.95%	['sftp_client_fuzz']
scan_scaled	116	29	25.0%	['sshconfig_fuzz']
globtilde	32	7	21.87%	['sshconfig_fuzz']
globextend	83	30	36.14%	['sshconfig_fuzz']
parse_forward	112	37	33.03%	['sshconfig_fuzz']
process_config_line_depth	1301	484	37.20%	['sshconfig_fuzz']
match_cfg_line	191	52	27.22%	['sshconfig_fuzz']
parse_fwd_field	43	18	41.86%	['sshconfig_fuzz']
choose_dh	65	11	16.92%	['kex_fuzz']
kex_send_kexinit	31	17	54.83%	['mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz', 'kex_fuzz', 'session_channel_req_fuzz']
libcrux_sha3_generic_keccak_portable_keccak1_22	36	16	44.44%	['kex_fuzz']
libcrux_sha3_generic_keccak_portable_keccak1_dc	36	16	44.44%	['kex_fuzz']
ssh_packet_send2	57	22	38.59%	['mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz', 'kex_fuzz', 'session_channel_req_fuzz']
ssh_packet_write_wait	40	8	20.0%	['mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz', 'kex_fuzz', 'session_channel_req_fuzz']
ssh_packet_close_internal	69	37	53.62%	['mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz', 'kex_fuzz', 'session_channel_req_fuzz']
sshkey_unshield_private	55	9	16.36%	['mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz', 'agent_fuzz', 'session_channel_req_fuzz', 'kex_fuzz']
private2_decrypt	124	65	52.41%	['mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz', 'agent_fuzz', 'session_channel_req_fuzz', 'kex_fuzz']
channel_register_fds	45	21	46.66%	['mux_fuzz', 'session_channel_req_fuzz', 'ssh_channels_fuzz']
kex_assemble_names	72	9	12.5%	['ssh_client_session_fuzz', 'sshd_auth_session_fuzz', 'session_channel_req_fuzz']
do_exec_no_pty	67	23	34.32%	['session_channel_req_fuzz']
do_exec	52	28	53.84%	['session_channel_req_fuzz']
session_pty_req	37	6	16.21%	['session_channel_req_fuzz']
session_subsystem_req	40	18	45.0%	['session_channel_req_fuzz']
sshbuf_set_max_size	33	16	48.48%	['mux_fuzz', 'session_channel_req_fuzz', 'ssh_channels_fuzz']
channel_open_message	54	26	48.14%	['mux_fuzz', 'session_channel_req_fuzz', 'ssh_channels_fuzz']
mux_master_read_cb	64	24	37.5%	['mux_fuzz']
mux_master_process_hello	40	9	22.5%	['mux_fuzz']
mux_master_process_new_session	134	59	44.02%	['mux_fuzz']
mux_master_process_stdio_fwd	75	33	44.0%	['mux_fuzz']
comp_status_message	34	11	32.35%	['mux_fuzz']
sshbuf_dtob64	33	18	54.54%	['sshd_auth_session_fuzz', 'privkey_fuzz', 'pubkey_fuzz']
process_read	48	18	37.5%	['sftp_server_msg_fuzz']
process_write	38	17	44.73%	['sftp_server_msg_fuzz']
process_fsetstat	49	13	26.53%	['sftp_server_msg_fuzz']
process_readdir	50	15	30.0%	['sftp_server_msg_fuzz']
process_rename	48	23	47.91%	['sftp_server_msg_fuzz']
process_extended_copy_data	95	34	35.78%	['sftp_server_msg_fuzz']
auth_log	45	7	15.55%	['sshd_auth_session_fuzz']
userauth_hostbased	94	12	12.76%	['sshd_auth_session_fuzz']
userauth_pubkey	197	41	20.81%	['sshd_auth_session_fuzz']
userauth_finish	61	30	49.18%	['sshd_auth_session_fuzz']
auth2_setup_methods_lists	33	5	15.15%	['sshd_auth_session_fuzz']
channel_proxy_upstream	63	8	12.69%	['ssh_channels_fuzz']
kex_input_ext_info	43	16	37.20%	['ssh_client_session_fuzz']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/openssh/ssh-ed25519-sk.c	[]	[]
/src/openssh/nchan.c	['session_channel_req_fuzz', 'ssh_channels_fuzz']	['ssh_channels_fuzz']
/src/openssh/auth-options.c	['authopt_fuzz', 'authkeys_fuzz']	['authopt_fuzz', 'authkeys_fuzz']
/src/openssh/openbsd-compat/bsd-misc.c	['session_channel_req_fuzz']	[]
/src/openssh/regress/misc/fuzz-harness/./../../../ssh-agent.c	['agent_fuzz']	[]
/src/openssh/ssh-rsa.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/./../../../mux.c	[]	[]
/src/openssh/monitor_fdpass.c	[]	[]
/src/openssh/kexgexs.c	[]	[]
/src/openssh/sshsig.c	['sshsig_fuzz', 'sshsigopt_fuzz']	['sshsig_fuzz', 'sshsigopt_fuzz']
/src/openssh/regress/misc/fuzz-harness/session_channel_req_fuzz.cc	['session_channel_req_fuzz']	['session_channel_req_fuzz']
/src/openssh/umac.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz']
/src/openssh/regress/misc/fuzz-harness/ssh-sk-null.cc	['ssh_client_session_fuzz']	[]
/src/openssh/auth2-pubkeyfile.c	['authkeys_fuzz']	['authkeys_fuzz']
/src/openssh/regress/misc/fuzz-harness/mux_fuzz.cc	['mux_fuzz']	['mux_fuzz']
/src/openssh/auth2-none.c	[]	[]
/src/openssh/hmac.c	['hostfile_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['hostfile_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/./../../../sftp-server.c	['sftp_server_msg_fuzz']	[]
/src/openssh/ed25519-openssl.c	[]	[]
/src/openssh/sshkey.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']
/src/openssh/kexmlkem768x25519.c	[]	[]
/src/openssh/auth.c	['sshd_auth_session_fuzz']	['sshd_auth_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/ssh_client_session_fuzz.cc	['ssh_client_session_fuzz']	['ssh_client_session_fuzz']
/src/openssh/smult_curve25519_ref.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/./../../../sshconnect2.c	['ssh_client_session_fuzz']	[]
/src/openssh/regress/misc/fuzz-harness/pubkey_fuzz.cc	['pubkey_fuzz']	['pubkey_fuzz']
/src/openssh/atomicio.c	['authfd_reply_fuzz', 'sftp_client_fuzz', 'agent_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'sftp_client_fuzz']
/src/openssh/openbsd-compat/./chacha_private.h	['hostfile_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/openbsd-compat/../crypto_api.h	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/addr.c	['authkeys_fuzz', 'misc_parse_fuzz', 'sshconfig_fuzz']	['authkeys_fuzz', 'misc_parse_fuzz']
/src/openssh/poly1305.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz']
/src/openssh/dispatch.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/readpass.c	['agent_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/regress/misc/fuzz-harness/sshsig_fuzz.cc	['sshsig_fuzz']	['sshsig_fuzz']
/src/openssh/digest-openssl.c	['krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['hostfile_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/ssh-ed25519.c	[]	[]
/src/openssh/mac.c	['sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/servconf.c	['session_channel_req_fuzz', 'sshd_auth_session_fuzz']	['session_channel_req_fuzz', 'sshd_auth_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/kex_fuzz.cc	['kex_fuzz']	['kex_fuzz']
/src/openssh/kexgen.c	[]	[]
/src/openssh/sshbuf.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']
/src/openssh/kexc25519.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/authkeys_fuzz.cc	['authkeys_fuzz']	['authkeys_fuzz']
/src/openssh/dns.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/./../../../auth2.c	['sshd_auth_session_fuzz']	[]
/src/openssh/auth2-pubkey.c	[]	[]
/src/openssh/auth2-passwd.c	[]	[]
/src/openssh/sftp-realpath.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/authfd_reply_fuzz.cc	['authfd_reply_fuzz']	['authfd_reply_fuzz']
/src/openssh/kexmlkem768ecdh.c	[]	[]
/src/openssh/bitmap.c	['krl_fuzz']	[]
/src/openssh/authfile.c	['authkeys_fuzz', 'ssh_client_session_fuzz']	['authkeys_fuzz']
/src/openssh/msg.c	[]	[]
/src/openssh/addrmatch.c	['authkeys_fuzz', 'misc_parse_fuzz', 'sshconfig_fuzz']	['authkeys_fuzz', 'misc_parse_fuzz']
/src/openssh/sshbuf-getput-crypto.c	[]	[]
/src/openssh/openbsd-compat/timingsafe_bcmp.c	['krl_fuzz', 'authkeys_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['krl_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/ssh_channels_fuzz.cc	['ssh_channels_fuzz']	['ssh_channels_fuzz']
/src/openssh/ssh-ecdsa-sk.c	[]	[]
/src/openssh/misc.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshsigopt_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshsigopt_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/ssherr.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['sftp_client_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz']
/src/openssh/regress/misc/fuzz-harness/misc_parse_fuzz.cc	['misc_parse_fuzz']	['misc_parse_fuzz']
/src/openssh/channels.c	['session_channel_req_fuzz', 'mux_fuzz', 'ssh_channels_fuzz']	['session_channel_req_fuzz', 'mux_fuzz', 'ssh_channels_fuzz']
/src/openssh/readconf.c	['sshconfig_fuzz', 'ssh_client_session_fuzz']	['sshconfig_fuzz', 'ssh_client_session_fuzz']
/src/openssh/kex-names.c	['sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/session.c	['session_channel_req_fuzz']	['session_channel_req_fuzz']
/src/openssh/openbsd-compat/strlcpy.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/openbsd-compat/strmode.c	[]	[]
/src/openssh/openbsd-compat/libressl-api-compat.c	[]	[]
/src/openssh/openbsd-compat/./arc4random.h	['hostfile_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/regress/misc/fuzz-harness/sftp_server_msg_fuzz.cc	['sftp_server_msg_fuzz']	['sftp_server_msg_fuzz']
/src/openssh/regress/misc/fuzz-harness/sftp_client_fuzz.cc	['sftp_client_fuzz']	['sftp_client_fuzz']
/src/openssh/regress/misc/fuzz-harness/ssh_client_session_fuzz_helper.c	['ssh_client_session_fuzz']	['ssh_client_session_fuzz']
/src/openssh/srclimit.c	[]	[]
/src/openssh/xmalloc.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/utf8.c	['krl_fuzz', 'sftp_client_fuzz', 'ssh_client_session_fuzz']	['ssh_client_session_fuzz']
/src/openssh/sshbuf-misc.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/privkey_fuzz.cc	['privkey_fuzz']	['privkey_fuzz']
/src/openssh/regress/misc/fuzz-harness/sshd_auth_session_fuzz_helper.c	['sshd_auth_session_fuzz']	['sshd_auth_session_fuzz']
/src/openssh/kexgexc.c	[]	[]
/src/openssh/openbsd-compat/pwcache.c	[]	[]
/src/openssh/ssh-pkcs11-client.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/openbsd-compat/recallocarray.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']
/src/openssh/sshlogin.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/session_channel_req_fuzz_helper.c	['session_channel_req_fuzz']	['session_channel_req_fuzz']
/src/openssh/openbsd-compat/mktemp.c	['sshconfig_fuzz']	['sshconfig_fuzz']
/src/openssh/platform-tracing.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/sig_fuzz.cc	['sig_fuzz']	['sig_fuzz']
/src/openssh/dh.c	[]	[]
/src/openssh/log.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']
/src/openssh/sshconnect.c	['ssh_client_session_fuzz']	[]
/src/openssh/openbsd-compat/bcrypt_pbkdf.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/regress/misc/fuzz-harness/agent_fuzz_helper.c	['agent_fuzz']	[]
/src/openssh/entropy.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/auth2-kbdint.c	[]	[]
/src/openssh/openbsd-compat/glob.c	['sshconfig_fuzz']	['sshconfig_fuzz']
/src/openssh/openbsd-compat/readpassphrase.c	['agent_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/sshpty.c	['session_channel_req_fuzz']	['session_channel_req_fuzz']
/src/openssh/sntrup761.c	[]	[]
/src/openssh/cipher.c	['sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/authopt_fuzz.cc	['authopt_fuzz']	['authopt_fuzz']
/src/openssh/regress/misc/fuzz-harness/sftp_server_msg_fuzz_helper.c	['sftp_server_msg_fuzz']	['sftp_server_msg_fuzz']
/src/openssh/./umac.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz']
/src/openssh/kexgex.c	[]	[]
/src/openssh/openbsd-compat/port-net.c	[]	[]
/src/openssh/openbsd-compat/setproctitle.c	['session_channel_req_fuzz', 'sshd_auth_session_fuzz']	['session_channel_req_fuzz', 'sshd_auth_session_fuzz']
/src/openssh/auth2-hostbased.c	[]	[]
/src/openssh/openbsd-compat/vis.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authkeys_fuzz', 'sftp_client_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/openbsd-compat/bsd-getentropy.c	['hostfile_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/ssh-sk.c	['agent_fuzz']	[]
/src/openssh/regress/misc/fuzz-harness/hostfile_fuzz.cc	['hostfile_fuzz']	['hostfile_fuzz']
/src/openssh/kexdh.c	[]	[]
/src/openssh/sftp-common.c	['sftp_client_fuzz']	['sftp_client_fuzz']
/src/openssh/regress/misc/fuzz-harness/mux_fuzz_helper.c	['mux_fuzz']	['mux_fuzz']
/src/openssh/krl.c	['krl_fuzz']	['krl_fuzz']
/src/openssh/auth2-chall.c	['sshd_auth_session_fuzz']	['sshd_auth_session_fuzz']
/src/openssh/platform-misc.c	[]	[]
/src/openssh/canohost.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/hostfile.c	['hostfile_fuzz']	['hostfile_fuzz']
/src/openssh/kexsntrup761x25519.c	[]	[]
/src/openssh/authfd.c	['authfd_reply_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz']
/src/openssh/libcrux-mlkem-mldsa.c	[]	[]
/src/openssh/openbsd-compat/base64.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/krl_fuzz.cc	['krl_fuzz']	['krl_fuzz']
/src/openssh/sshbuf-io.c	['ssh_client_session_fuzz']	[]
/src/openssh/openbsd-compat/fmt_scaled.c	['sshconfig_fuzz']	['sshconfig_fuzz']
/src/openssh/groupaccess.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/sshconfig_fuzz.cc	['sshconfig_fuzz']	['sshconfig_fuzz']
/src/openssh/fatal.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['sftp_client_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/openbsd-compat/arc4random.c	['hostfile_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/fuzz_arena.c	['authfd_reply_fuzz', 'sftp_client_fuzz', 'sftp_server_msg_fuzz']	['authfd_reply_fuzz', 'sftp_client_fuzz', 'sftp_server_msg_fuzz']
/src/openssh/openbsd-compat/blowfish.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/ssh_api.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/openbsd-compat/bsd-getpeereid.c	[]	[]
/src/openssh/platform-pledge.c	[]	[]
/src/openssh/openbsd-compat/strtonum.c	['authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sshconfig_fuzz']	['authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sshconfig_fuzz']
/src/openssh/openbsd-compat/getrrsetbyname.c	[]	[]
/src/openssh/ttymodes.c	['session_channel_req_fuzz']	[]
/src/openssh/openbsd-compat/arc4random_uniform.c	['session_channel_req_fuzz', 'sshd_auth_session_fuzz']	['sshd_auth_session_fuzz']
/src/openssh/openbsd-compat/bsd-closefrom.c	['sshconfig_fuzz', 'session_channel_req_fuzz', 'agent_fuzz', 'ssh_client_session_fuzz']	[]
/src/openssh/kexecdh.c	[]	[]
/src/openssh/openbsd-compat/strlcat.c	['krl_fuzz', 'authkeys_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['authkeys_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/openbsd-compat/openssl-compat.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/ssh-ecdsa.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz']
/src/openssh/openbsd-compat/getopt_long.c	[]	[]
/src/openssh/misc-agent.c	['session_channel_req_fuzz', 'agent_fuzz']	[]
/src/openssh/./libcrux_internal.h	[]	[]
/src/openssh/ssh-mldsa-eddsa.c	[]	[]
/src/openssh/auth2-methods.c	['sshd_auth_session_fuzz']	[]
/src/openssh/openbsd-compat/freezero.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']
/src/openssh/sshbuf-getput-basic.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['authfd_reply_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']
/src/openssh/sftp-client.c	['sftp_client_fuzz']	['sftp_client_fuzz']
/src/openssh/packet.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/../sk-dummy/sk-dummy.c	[]	[]
/src/openssh/regress/misc/fuzz-harness/sshsigopt_fuzz.cc	['sshsigopt_fuzz']	['sshsigopt_fuzz']
/src/openssh/cipher-chachapoly-libcrypto.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz']
/src/openssh/kex.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/compat.c	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/regress/misc/fuzz-harness/agent_fuzz.cc	['agent_fuzz']	[]
/src/openssh/regress/misc/fuzz-harness/sshd_auth_session_fuzz.cc	['sshd_auth_session_fuzz']	['sshd_auth_session_fuzz']
/src/openssh/match.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sshconfig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'sshsig_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'ssh_client_session_fuzz']
/src/openssh/ssherr-libcrypto.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sftp_client_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'session_channel_req_fuzz', 'mux_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'sftp_server_msg_fuzz', 'agent_fuzz', 'sshd_auth_session_fuzz', 'ssh_channels_fuzz', 'pubkey_fuzz', 'ssh_client_session_fuzz']	['kex_fuzz']
/src/openssh/cleanup.c	['authfd_reply_fuzz', 'krl_fuzz', 'hostfile_fuzz', 'authopt_fuzz', 'authkeys_fuzz', 'misc_parse_fuzz', 'sshconfig_fuzz', 'sig_fuzz', 'kex_fuzz', 'privkey_fuzz', 'sshsig_fuzz', 'pubkey_fuzz']	[]

Directories in report

Directory
/src/openssh/
/src/openssh/openbsd-compat/
/src/openssh/regress/misc/fuzz-harness/../sk-dummy/
/src/openssh/openbsd-compat/./
/src/openssh/openbsd-compat/../
/src/openssh/./
/src/openssh/regress/misc/fuzz-harness/./../../../
/src/openssh/regress/misc/fuzz-harness/