High level conclusions

Fuzzer bndiv is blocked:

The runtime code coverage of bndiv covers 14.72% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer punycode is blocked:

The runtime code coverage of punycode covers 1.630% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pem is blocked:

The runtime code coverage of pem covers 20.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ct is blocked:

The runtime code coverage of ct covers 23.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer v3name is blocked:

The runtime code coverage of v3name covers 21.29% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer asn1parse is blocked:

The runtime code coverage of asn1parse covers 26.43% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bignum is blocked:

The runtime code coverage of bignum covers 17.67% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ct_30 is blocked:

The runtime code coverage of ct_30 covers 22.12% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bignum_30 is blocked:

The runtime code coverage of bignum_30 covers 21.88% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bndiv_30 is blocked:

The runtime code coverage of bndiv_30 covers 18.96% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer conf is blocked:

The runtime code coverage of conf covers 22.03% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer conf_30 is blocked:

The runtime code coverage of conf_30 covers 19.95% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer asn1parse_30 is blocked:

The runtime code coverage of asn1parse_30 covers 24.31% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bignum_111 is blocked:

The runtime code coverage of bignum_111 covers 22.36% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer conf_111 is blocked:

The runtime code coverage of conf_111 covers 20.18% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ct_111 is blocked:

The runtime code coverage of ct_111 covers 22.79% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer asn1parse_111 is blocked:

The runtime code coverage of asn1parse_111 covers 22.40% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bndiv_111 is blocked:

The runtime code coverage of bndiv_111 covers 18.46% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 28.64% of cyclomatic complexity.

Fuzzers reach 28.20% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

4239 / 15028

Cyclomatic complexity statically reachable by fuzzers

22606 / 78931

Runtime code coverage of functions

2944 / 15028

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: bndiv_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2608	87.4%
gold	[1:9]	183	6.13%
yellow	[10:29]	6	0.20%
greenyellow	[30:49]	3	0.10%
lawngreen	50+	181	6.07%
All colors	2981	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 02948	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_new	call site: 00000	/src/openssl111/crypto/bn/bn_ctx.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 02832	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_STACK_push	call site: 02829	/src/openssl111/crypto/bn/bn_ctx.c:264
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_POOL_get	call site: 02833	/src/openssl111/crypto/bn/bn_ctx.c:318
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 02825	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_new	call site: 00004	/src/openssl111/crypto/bn/bn_lib.c:246
3455	3455	1 : View List ['ERR_put_error']	3455	3455	bn_expand_internal	call site: 00907	/src/openssl111/crypto/bn/bn_lib.c:281
3455	3455	1 : View List ['ERR_put_error']	3455	3455	OPENSSL_init_crypto	call site: 00009	/src/openssl111/crypto/init.c:613
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00014	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00042	/src/openssl111/crypto/init.c:440
95	95	1 : View List ['BN_free']	95	95	BN_bin2bn	call site: 02815	/src/openssl111/crypto/bn/bn_lib.c:454

Runtime coverage analysis

Covered functions

176

Functions that are reachable but not covered

755

Reachable functions

926

Percentage of reachable functions covered

18.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/bndiv.c	1
openssl111/crypto/bn/bn_lib.c	24
openssl111/crypto/mem.c	7
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	7
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	3
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	3
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/bn/bn_div.c	3
openssl111/crypto/bn/bn_ctx.c	7
openssl111/crypto/bn/bn_mul.c	6
openssl111/crypto/bn/bn_add.c	3

Fuzzer: asn1parse_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2464	84.9%
gold	[1:9]	162	5.58%
yellow	[10:29]	35	1.20%
greenyellow	[30:49]	3	0.10%
lawngreen	50+	236	8.13%
All colors	2900	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10856	14311	3 : View List ['ERR_add_error_data', 'asn1_template_ex_d2i', 'ERR_put_error']	10856	14311	asn1_item_embed_d2i	call site: 02189	/src/openssl111/crypto/asn1/tasn_dec.c:166
6994	13904	3 : View List ['BUF_MEM_grow_clean', 'ERR_put_error', 'asn1_collect']	6994	17643	asn1_d2i_ex_primitive	call site: 02220	/src/openssl111/crypto/asn1/tasn_dec.c:745
3675	3675	2 : View List ['ASN1_TYPE_new', 'ASN1_TYPE_set']	7153	45354	asn1_ex_c2i	call site: 02249	/src/openssl111/crypto/asn1/tasn_dec.c:807
3566	3566	1 : View List ['asn1_template_free']	3566	3566	asn1_item_embed_free	call site: 02078	/src/openssl111/crypto/asn1/tasn_fre.c:48
3486	3486	1 : View List ['asn1_find_end']	3486	10680	asn1_d2i_ex_primitive	call site: 02218	/src/openssl111/crypto/asn1/tasn_dec.c:719
3458	13823	3 : View List ['__errno_location', 'ERR_add_error_data', 'ERR_put_error']	3458	13823	BIO_new_file	call site: 01695	/src/openssl111/crypto/bio/bss_file.c:68
3458	3458	1 : View List ['OBJ_nid2sn']	3464	24441	OBJ_obj2txt	call site: 02405	/src/openssl111/crypto/objects/obj_dat.c:415
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00013	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00041	/src/openssl111/crypto/init.c:440
82	82	1 : View List ['CRYPTO_secure_zalloc']	82	3537	bn_expand_internal	call site: 00878	/src/openssl111/crypto/bn/bn_lib.c:277
80	80	1 : View List ['CRYPTO_secure_clear_free']	80	80	bn_free_d	call site: 00912	/src/openssl111/crypto/bn/bn_lib.c:203
47	56	6 : View List ['lh_OBJ_NAME_free', 'lh_OBJ_NAME_get_down_load', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall']	47	56	OBJ_NAME_cleanup	call site: 00287	/src/openssl111/crypto/objects/o_names.c:393

Runtime coverage analysis

Covered functions

233

Functions that are reachable but not covered

755

Reachable functions

973

Percentage of reachable functions covered

22.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/asn1parse.c	1
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	11
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/bio/b_dump.c	4

Fuzzer: ct_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2594	85.7%
gold	[1:9]	146	4.82%
yellow	[10:29]	35	1.15%
greenyellow	[30:49]	3	0.09%
lawngreen	50+	246	8.13%
All colors	3024	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10856	14311	3 : View List ['ERR_add_error_data', 'asn1_template_ex_d2i', 'ERR_put_error']	10856	14311	asn1_item_embed_d2i	call site: 00007	/src/openssl111/crypto/asn1/tasn_dec.c:166
3683	3683	1 : View List ['asn1_template_ex_i2d']	3683	3683	ASN1_item_ex_i2d	call site: 02958	/src/openssl111/crypto/asn1/tasn_enc.c:100
3675	3675	2 : View List ['ASN1_TYPE_new', 'ASN1_TYPE_set']	17694	45354	asn1_ex_c2i	call site: 02701	/src/openssl111/crypto/asn1/tasn_dec.c:807
3566	3566	1 : View List ['asn1_template_free']	3566	3566	asn1_item_embed_free	call site: 02080	/src/openssl111/crypto/asn1/tasn_fre.c:48
3486	3486	1 : View List ['asn1_find_end']	3486	10680	asn1_d2i_ex_primitive	call site: 02672	/src/openssl111/crypto/asn1/tasn_dec.c:719
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	asn1_time_from_tm	call site: 02891	/src/openssl111/crypto/asn1/a_time.c:283
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00015	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00043	/src/openssl111/crypto/init.c:440
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow_clean	call site: 02690	/src/openssl111/crypto/buffer/buffer.c:132
47	56	6 : View List ['lh_OBJ_NAME_free', 'lh_OBJ_NAME_get_down_load', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall']	47	56	OBJ_NAME_cleanup	call site: 00289	/src/openssl111/crypto/objects/o_names.c:393
46	46	1 : View List ['async_delete_thread_state']	3498	3523	ossl_init_thread_stop	call site: 00020	/src/openssl111/crypto/init.c:424
45	45	3 : View List ['lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free', 'lh_ADDED_OBJ_set_down_load']	45	45	obj_cleanup_int	call site: 00340	/src/openssl111/crypto/objects/obj_dat.c:155

Runtime coverage analysis

Covered functions

238

Functions that are reachable but not covered

789

Reachable functions

1022

Percentage of reachable functions covered

22.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/ct.c	1
openssl111/crypto/ct/ct_oct.c	8
openssl111/crypto/asn1/tasn_typ.c	11
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	14
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/include/openssl/ct.h	8
openssl111/crypto/ct/ct_sct.c	7
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/ct/ct_prn.c	4
openssl111/crypto/ct/ct_log.c	2
openssl111/crypto/bio/b_dump.c	1
openssl111/crypto/asn1/a_gentm.c	5
openssl111/crypto/o_time.c	5
openssl111/crypto/asn1/a_time.c	6
openssl111/crypto/asn1/tasn_enc.c	8

Fuzzer: conf_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2515	89.0%
gold	[1:9]	172	6.08%
yellow	[10:29]	1	0.03%
greenyellow	[30:49]	3	0.10%
lawngreen	50+	134	4.74%
All colors	2825	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00012	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00040	/src/openssl111/crypto/init.c:440
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:94
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow_clean	call site: 02235	/src/openssl111/crypto/buffer/buffer.c:132
80	80	1 : View List ['CRYPTO_secure_clear_free']	80	84	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:48
47	56	6 : View List ['lh_OBJ_NAME_free', 'lh_OBJ_NAME_get_down_load', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall']	47	56	OBJ_NAME_cleanup	call site: 00286	/src/openssl111/crypto/objects/o_names.c:393
46	46	1 : View List ['async_delete_thread_state']	3498	3523	ossl_init_thread_stop	call site: 00017	/src/openssl111/crypto/init.c:424
45	45	3 : View List ['lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free', 'lh_ADDED_OBJ_set_down_load']	45	45	obj_cleanup_int	call site: 00337	/src/openssl111/crypto/objects/obj_dat.c:155
33	33	2 : View List ['ossl_strtouint64', 'ossl_strchr']	37	37	OPENSSL_cpuid_setup	call site: 02802	/src/openssl111/crypto/cryptlib.c:108
14	14	1 : View List ['bio_call_callback']	14	3489	BIO_free	call site: 01808	/src/openssl111/crypto/bio/bio_lib.c:125
14	14	1 : View List ['bio_call_callback']	14	14	BIO_gets	call site: 01738	/src/openssl111/crypto/bio/bio_lib.c:465
14	14	1 : View List ['bio_call_callback']	14	14	BIO_ctrl	call site: 01713	/src/openssl111/crypto/bio/bio_lib.c:530

Runtime coverage analysis

Covered functions

249

Functions that are reachable but not covered

708

Reachable functions

887

Percentage of reachable functions covered

20.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/conf.c	1
openssl111/crypto/conf/conf_lib.c	9
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1

Fuzzer: crl_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2334	73.8%
gold	[1:9]	144	4.55%
yellow	[10:29]	36	1.13%
greenyellow	[30:49]	3	0.09%
lawngreen	50+	644	20.3%
All colors	3161	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7150	10608	3 : View List ['CRYPTO_free', 'ENGINE_finish', 'EVP_PKEY_free']	7150	10608	EVP_PKEY_CTX_free	call site: 02068	/src/openssl111/crypto/evp/pmeth_lib.c:354
6926	6926	2 : View List ['ENGINE_get_pkey_asn1_meth', 'ENGINE_get_pkey_asn1_meth_engine']	6926	6926	EVP_PKEY_asn1_find	call site: 02206	/src/openssl111/crypto/asn1/ameth_lib.c:88
3462	3462	1 : View List ['EVP_PKEY_CTX_ctrl']	3462	3462	EVP_DigestInit_ex	call site: 02047	/src/openssl111/crypto/evp/digest.c:149
3458	6923	4 : View List ['CRYPTO_THREAD_unlock', 'engine_unlocked_finish', 'ERR_put_error', 'CRYPTO_THREAD_write_lock']	3458	6923	ENGINE_finish	call site: 00167	/src/openssl111/crypto/engine/eng_init.c:99
3456	6910	2 : View List ['ENGINE_get_digest', 'ENGINE_finish']	6918	17312	EVP_DigestInit_ex	call site: 02030	/src/openssl111/crypto/evp/digest.c:107
3456	3456	1 : View List ['ENGINE_init']	10374	24223	EVP_DigestInit_ex	call site: 02028	/src/openssl111/crypto/evp/digest.c:98
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	asn1_time_from_tm	call site: 00000	/src/openssl111/crypto/asn1/a_time.c:283
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00014	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00042	/src/openssl111/crypto/init.c:440
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow	call site: 02872	/src/openssl111/crypto/buffer/buffer.c:94
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow_clean	call site: 02689	/src/openssl111/crypto/buffer/buffer.c:132
76	76	1 : View List ['CRYPTO_secure_malloc']	76	76	CRYPTO_secure_zalloc	call site: 00880	/src/openssl111/crypto/mem_sec.c:143

Runtime coverage analysis

Covered functions

630

Functions that are reachable but not covered

688

Reachable functions

1081

Percentage of reachable functions covered

36.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/crl.c	1
openssl111/crypto/x509/x_crl.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	5
openssl111/crypto/objects/obj_xref.h	4
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	7
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	5
openssl111/crypto/asn1/tasn_typ.c	12
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/x509/t_crl.c	2
openssl111/crypto/x509/x509cset.c	10
openssl111/crypto/x509/t_x509.c	2
openssl111/crypto/bio/b_dump.c	4
openssl111/crypto/asn1/a_strex.c	8
openssl111/crypto/x509/x_name.c	1
openssl111/crypto/x509/x509_obj.c	1
openssl111/crypto/x509/x509name.c	5
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/asn1/a_utf8.c	2
openssl111/crypto/asn1/a_time.c	4
openssl111/crypto/o_time.c	4
openssl111/crypto/x509v3/v3_prn.c	4
openssl111/crypto/x509/x509_v3.c	3
openssl111/crypto/x509v3/v3_lib.c	4
openssl111/include/openssl/x509v3.h	2
openssl111/crypto/asn1/a_print.c	1
openssl111/crypto/asn1/f_int.c	1

Fuzzer: bignum_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2800	81.1%
gold	[1:9]	183	5.30%
yellow	[10:29]	5	0.14%
greenyellow	[30:49]	6	0.17%
lawngreen	50+	458	13.2%
All colors	3452	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6928	45323	9 : View List ['BN_div', 'BN_lshift1', 'BN_mul_word', 'BN_num_bits', 'BN_mul', 'BN_set_word', 'BN_lshift', 'BN_is_word', 'BN_add']	6928	73297	int_bn_mod_inverse	call site: 03039	/src/openssl111/crypto/bn/bn_gcd.c:260
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 02883	/src/openssl111/crypto/bn/bn_gcd.c:213
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 03013	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_new	call site: 02818	/src/openssl111/crypto/bn/bn_ctx.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 02851	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_STACK_push	call site: 02848	/src/openssl111/crypto/bn/bn_ctx.c:264
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_POOL_get	call site: 02852	/src/openssl111/crypto/bn/bn_ctx.c:318
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 02901	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_mod_exp_recp	call site: 03343	/src/openssl111/crypto/bn/bn_exp.c:180
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_mod_exp_simple	call site: 03401	/src/openssl111/crypto/bn/bn_exp.c:1315
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_new	call site: 00003	/src/openssl111/crypto/bn/bn_lib.c:246
3455	3455	1 : View List ['ERR_put_error']	3455	3455	bn_expand_internal	call site: 00906	/src/openssl111/crypto/bn/bn_lib.c:281

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

781

Reachable functions

1006

Percentage of reachable functions covered

22.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/bignum.c	1
openssl111/crypto/bn/bn_lib.c	33
openssl111/crypto/mem.c	7
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	10
openssl111/include/internal/constant_time.h	6
openssl111/crypto/bn/bn_shift.c	6
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	3
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/bn/bn_ctx.c	10
openssl111/crypto/bn/bn_exp.c	9
openssl111/crypto/bn/bn_mont.c	10
openssl111/crypto/bn/bn_gcd.c	3
openssl111/crypto/bn/bn_mod.c	2
openssl111/crypto/bn/bn_div.c	3
openssl111/crypto/bn/bn_mul.c	6
openssl111/crypto/bn/bn_add.c	4
openssl111/crypto/bn/bn_sqr.c	4
openssl111/crypto/bn/rsaz_exp.c	2
openssl111/crypto/bn/rsaz_exp.h	2
openssl111/crypto/bn/bn_recp.c	6

Fuzzer: x509_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2299	71.5%
gold	[1:9]	168	5.23%
yellow	[10:29]	42	1.30%
greenyellow	[30:49]	9	0.28%
lawngreen	50+	694	21.6%
All colors	3212	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7290	7290	2 : View List ['RAND_DRBG_bytes', 'RAND_DRBG_get0_private']	7290	7290	RAND_priv_bytes	call site: 00000	/src/openssl111/crypto/rand/rand_lib.c:930
4325	11535	9 : View List ['ERR_put_error', 'X25519_public_from_private', 'X448_public_from_private', 'ED25519_public_from_private', 'RAND_priv_bytes', 'CRYPTO_free', 'ED448_public_from_private', 'CRYPTO_secure_malloc', 'CRYPTO_secure_free']	4325	15103	ecx_key_op	call site: 00000	/src/openssl111/crypto/ec/ecx_meth.c:77
3816	3816	1 : View List ['BN_mod_exp_recp']	3816	3816	BN_mod_exp	call site: 00000	/src/openssl111/crypto/bn/bn_exp.c:143
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 00000	/src/openssl111/crypto/bn/bn_gcd.c:213
3665	3665	1 : View List ['rsa_multip_calc_product']	3665	3665	rsa_cb	call site: 00000	/src/openssl111/crypto/rsa/rsa_asn1.c:35
3508	3508	1 : View List ['unsup_alg']	3508	3508	EVP_PKEY_print_public	call site: 03048	/src/openssl111/crypto/evp/p_lib.c:645
3499	3499	1 : View List ['EVP_PKEY_asn1_find_str']	6955	17319	pkey_set_type	call site: 02203	/src/openssl111/crypto/evp/p_lib.c:201
3472	6926	3 : View List ['ENGINE_get_RAND', 'ENGINE_finish', 'ENGINE_get_default_RAND']	3472	6931	RAND_get_rand_method	call site: 00000	/src/openssl111/crypto/rand/rand_lib.c:856
3462	3462	1 : View List ['EVP_PKEY_CTX_ctrl']	3462	3462	EVP_DigestInit_ex	call site: 02047	/src/openssl111/crypto/evp/digest.c:149
3460	3460	1 : View List ['EC_KEY_priv2buf']	3460	21245	do_EC_KEY_print	call site: 00000	/src/openssl111/crypto/ec/ec_ameth.c:378
3458	6923	4 : View List ['CRYPTO_THREAD_unlock', 'engine_unlocked_finish', 'ERR_put_error', 'CRYPTO_THREAD_write_lock']	3458	6923	ENGINE_finish	call site: 00167	/src/openssl111/crypto/engine/eng_init.c:99
3456	6910	2 : View List ['ENGINE_get_digest', 'ENGINE_finish']	6918	17312	EVP_DigestInit_ex	call site: 02030	/src/openssl111/crypto/evp/digest.c:107

Runtime coverage analysis

Covered functions

956

Functions that are reachable but not covered

697

Reachable functions

1137

Percentage of reachable functions covered

38.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/x509.c	1
openssl111/crypto/x509/x_x509.c	4
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	5
openssl111/crypto/objects/obj_xref.h	4
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	2
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	8
openssl111/include/openssl/x509.h	5
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	6
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	5
openssl111/crypto/asn1/tasn_typ.c	12
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/x509/t_x509.c	5
openssl111/crypto/x509/x509_set.c	7
openssl111/crypto/x509/x509_cmp.c	5
openssl111/crypto/bio/b_dump.c	4
openssl111/crypto/asn1/a_strex.c	8
openssl111/crypto/x509/x_name.c	1
openssl111/crypto/x509/x509_obj.c	1
openssl111/crypto/x509/x509name.c	5
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/asn1/a_utf8.c	2
openssl111/crypto/asn1/a_time.c	4
openssl111/crypto/o_time.c	4
openssl111/crypto/x509/x_pubkey.c	3
openssl111/crypto/x509v3/v3_prn.c	4
openssl111/crypto/x509/x509_v3.c	3
openssl111/crypto/x509v3/v3_lib.c	4
openssl111/include/openssl/x509v3.h	2
openssl111/crypto/asn1/a_print.c	1
openssl111/crypto/x509/x_x509a.c	5

Fuzzer: cms_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2246	77.0%
gold	[1:9]	178	6.10%
yellow	[10:29]	34	1.16%
greenyellow	[30:49]	4	0.13%
lawngreen	50+	453	15.5%
All colors	2915	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5391	5545	2 : View List ['EC_GROUP_free', 'EC_GROUP_new_from_ecpkparameters']	5391	16130	d2i_ECPKParameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:960
3959	7524	2 : View List ['RSA_PSS_PARAMS_free', 'rsa_mgf1_decode']	3959	7524	rsa_pss_decode	call site: 00000	/src/openssl111/crypto/rsa/rsa_ameth.c:438
3816	3816	1 : View List ['BN_mod_exp_recp']	3816	3816	BN_mod_exp	call site: 00000	/src/openssl111/crypto/bn/bn_exp.c:143
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 00000	/src/openssl111/crypto/bn/bn_gcd.c:213
3665	3665	1 : View List ['rsa_multip_calc_product']	3665	3665	rsa_cb	call site: 00000	/src/openssl111/crypto/rsa/rsa_asn1.c:35
3594	3594	1 : View List ['rand_drbg_restart']	7063	27797	RAND_DRBG_generate	call site: 00000	/src/openssl111/crypto/rand/drbg_lib.c:573
3505	17383	9 : View List ['rand_pool_add_end', 'read', 'rand_pool_bytes_needed', 'wait_random_seeded', 'rand_pool_entropy_available', 'close_random_device', 'rand_pool_add_begin', '__errno_location', 'get_random_device']	3505	17383	rand_pool_acquire_entropy	call site: 00000	/src/openssl111/crypto/rand/rand_unix.c:662
3499	3499	1 : View List ['EVP_PKEY_asn1_find_str']	6955	17319	pkey_set_type	call site: 02384	/src/openssl111/crypto/evp/p_lib.c:201
3495	3495	1 : View List ['EVP_DecryptUpdate']	3495	3495	EVP_CipherUpdate	call site: 02478	/src/openssl111/crypto/evp/evp_enc.c:213
3484	3484	1 : View List ['RAND_bytes']	3484	6954	bnrand	call site: 00000	/src/openssl111/crypto/bn/bn_rand.c:50
3474	3474	1 : View List ['ASN1_INTEGER_get']	3474	10384	asn1_do_adb	call site: 02103	/src/openssl111/crypto/asn1/tasn_utl.c:219
3467	3467	1 : View List ['RAND_DRBG_reseed']	3467	10377	RAND_DRBG_generate	call site: 00000	/src/openssl111/crypto/rand/drbg_lib.c:618

Runtime coverage analysis

Covered functions

779

Functions that are reachable but not covered

675

Reachable functions

976

Percentage of reachable functions covered

30.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/cms.c	1
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/mem.c	7
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	4
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/cms/cms_io.c	2
openssl111/crypto/asn1/a_d2i_fp.c	2
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/asn1/a_i2d_fp.c	1
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/cms/cms_lib.c	1

Fuzzer: asn1_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2165	43.8%
gold	[1:9]	772	15.6%
yellow	[10:29]	53	1.07%
greenyellow	[30:49]	33	0.66%
lawngreen	50+	1913	38.7%
All colors	4936	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7290	7290	2 : View List ['RAND_DRBG_bytes', 'RAND_DRBG_get0_private']	7290	7290	RAND_priv_bytes	call site: 00000	/src/openssl111/crypto/rand/rand_lib.c:930
4529	4529	1 : View List ['TS_TST_INFO_print_bio']	4529	4529	TS_RESP_print_bio	call site: 03205	/src/openssl111/crypto/ts/ts_rsp_print.c:34
3959	7524	2 : View List ['RSA_PSS_PARAMS_free', 'rsa_mgf1_decode']	3959	7524	rsa_pss_decode	call site: 00000	/src/openssl111/crypto/rsa/rsa_ameth.c:438
3816	3816	1 : View List ['BN_mod_exp_recp']	3816	3816	BN_mod_exp	call site: 04025	/src/openssl111/crypto/bn/bn_exp.c:143
3781	7255	2 : View List ['def_load_bio', 'BIO_free']	3781	7255	def_load	call site: 00000	/src/openssl111/crypto/conf/conf_def.c:166
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 03678	/src/openssl111/crypto/bn/bn_gcd.c:213
3590	3590	2 : View List ['ecp_nistz256_windowed_mul', 'ecp_nistz256_point_add']	3590	13976	ecp_nistz256_points_mul	call site: 00000	/src/openssl111/crypto/ec/ecp_nistz256.c:1142
3565	7020	2 : View List ['ERR_put_error', 'ECPARAMETERS_free']	3565	7020	EC_GROUP_get_ecparameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:517
3565	3565	1 : View List ['ECPARAMETERS_free']	3565	18035	EC_GROUP_get_ecpkparameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:538
3508	3508	1 : View List ['unsup_alg']	3508	3508	EVP_PKEY_print_private	call site: 03394	/src/openssl111/crypto/evp/p_lib.c:654
3508	3508	1 : View List ['unsup_alg']	3508	3508	EVP_PKEY_print_params	call site: 03422	/src/openssl111/crypto/evp/p_lib.c:663
3480	6938	5 : View List ['BIO_ctrl', 'BIO_new', 'BIO_clear_flags', 'BIO_s_file', 'fclose']	3480	6938	BIO_new_file	call site: 01694	/src/openssl111/crypto/bio/bss_file.c:68

Runtime coverage analysis

Covered functions

1575

Functions that are reachable but not covered

508

Reachable functions

1563

Percentage of reachable functions covered

67.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/asn1.c	1
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	46
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	7
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	2
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	9
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	23
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	35
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	10
openssl111/include/internal/constant_time.h	6
openssl111/crypto/bn/bn_shift.c	6
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	9
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	6
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	29
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	6
openssl111/crypto/engine/tb_eckey.c	5
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	3
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	12
openssl111/include/openssl/x509.h	6
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	12
openssl111/crypto/asn1/p8_pkey.c	5
openssl111/crypto/evp/evp_pkey.c	2
openssl111/crypto/bn/bn_print.c	2
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	3
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	8
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	5
openssl111/crypto/asn1/tasn_typ.c	13
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	3
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/asn1/tasn_prn.c	9
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/asn1/a_utctm.c	1
openssl111/crypto/asn1/a_time.c	4
openssl111/crypto/o_time.c	4
openssl111/crypto/asn1/a_gentm.c	1
openssl111/crypto/bio/b_dump.c	4
openssl111/crypto/asn1/a_strex.c	6
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/asn1/a_utf8.c	2
openssl111/crypto/ts/ts_asn1.c	9
openssl111/crypto/ts/ts_req_print.c	1
openssl111/crypto/ts/ts_req_utils.c	2
openssl111/crypto/ts/ts_lib.c	5
openssl111/crypto/x509/x509_v3.c	5
openssl111/crypto/x509v3/v3_prn.c	3
openssl111/crypto/x509v3/v3_lib.c	4
openssl111/include/openssl/x509v3.h	2
openssl111/crypto/asn1/a_print.c	1
openssl111/crypto/ts/ts_rsp_print.c	5
openssl111/crypto/x509v3/v3_alt.c	1
openssl111/crypto/x509/x509_obj.c	1
openssl111/crypto/dh/dh_asn1.c	3
openssl111/crypto/dh/dh_ameth.c	2
openssl111/crypto/asn1/t_pkey.c	2
openssl111/crypto/bn/bn_intern.c	1
openssl111/crypto/dh/dh_lib.c	3
openssl111/crypto/dsa/dsa_asn1.c	4
openssl111/crypto/dsa/dsa_prn.c	2
openssl111/crypto/dsa/dsa_lib.c	2
openssl111/crypto/rsa/rsa_asn1.c	2
openssl111/crypto/rsa/rsa_prn.c	1
openssl111/crypto/rsa/rsa_lib.c	2
openssl111/crypto/rsa/rsa_local.h	1
openssl111/crypto/rsa/rsa_mp.c	2
openssl111/crypto/bn/bn_blind.c	1
openssl111/crypto/ec/ec_asn1.c	11
openssl111/crypto/ec/ec_curve.c	4
openssl111/crypto/ec/ec_lib.c	37
openssl111/crypto/bn/bn_ctx.c	13
openssl111/crypto/ec/ec_cvt.c	2
openssl111/crypto/ec/ecp_mont.c	1
openssl111/crypto/ec/ecp_nistz256.c	2
openssl111/crypto/ec/ecp_nistp224.c	2
openssl111/crypto/ec/ecp_nistp256.c	2
openssl111/crypto/ec/ecp_nistp521.c	2
openssl111/crypto/ec/ec_mult.c	2
openssl111/crypto/bn/bn_mont.c	10
openssl111/crypto/ec/ec2_smpl.c	1
openssl111/crypto/ec/ec_local.h	1
openssl111/crypto/bn/bn_add.c	4
openssl111/crypto/bn/bn_div.c	3
openssl111/crypto/bn/bn_gcd.c	3
openssl111/crypto/bn/bn_mod.c	7
openssl111/crypto/bn/bn_mul.c	6
openssl111/crypto/ec/ec_oct.c	4
openssl111/crypto/ec/ecp_oct.c	3
openssl111/crypto/bn/bn_sqr.c	4
openssl111/crypto/bn/bn_sqrt.c	1
openssl111/crypto/bn/bn_exp.c	8
openssl111/crypto/bn/rsaz_exp.c	2
openssl111/crypto/bn/rsaz_exp.h	2
openssl111/crypto/bn/bn_recp.c	6
openssl111/crypto/bn/bn_rand.c	2
openssl111/crypto/bn/bn_kron.c	1
openssl111/crypto/ec/ec2_oct.c	3
openssl111/crypto/bn/bn_gf2m.c	7
openssl111/crypto/ec/eck_prn.c	2
openssl111/crypto/ec/ec_print.c	1
openssl111/crypto/ec/ec_key.c	10
openssl111/crypto/ec/ec_ameth.c	3
openssl111/crypto/asn1/i2d_pr.c	1
openssl111/ssl/ssl_asn1.c	4
openssl111/ssl/ssl_sess.c	2
openssl111/ssl/ssl_init.c	8
openssl111/ssl/ssl_ciph.c	11
openssl111/include/openssl/ssl.h	6
openssl111/crypto/comp/comp_lib.c	2
openssl111/ssl/s3_lib.c	3
openssl111/ssl/ssl_err.c	1
openssl111/ssl/ssl_lib.c	3
openssl111/crypto/x509/x_x509.c	1
openssl111/ssl/ssl_txt.c	1
openssl111/crypto/evp/e_null.c	1
openssl111/crypto/x509/x509_txt.c	1

Fuzzer: client_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2090	54.6%
gold	[1:9]	766	20.0%
yellow	[10:29]	37	0.96%
greenyellow	[30:49]	13	0.34%
lawngreen	50+	917	23.9%
All colors	3823	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
21421	70718	11 : View List ['ssl_add_cert_to_wpacket', 'X509_STORE_CTX_init', 'sk_X509_value.1369', 'X509_STORE_CTX_free', 'ERR_clear_error', 'X509_STORE_CTX_new', 'X509_verify_cert', 'sk_X509_num', 'ssl_security_cert_chain', 'X509_STORE_CTX_get0_chain', 'ossl_statem_fatal']	21421	70718	ssl_add_cert_chain	call site: 00000	/src/openssl111/ssl/statem/statem_lib.c:919
19882	19892	6 : View List ['X509v3_addr_validate_path', 'X509v3_asid_validate_path', 'verify_cb_cert', 'X509_chain_check_suiteb', 'internal_verify', 'check_name_constraints']	19882	19892	verify_chain	call site: 00000	/src/openssl111/crypto/x509/x509_vfy.c:222
14662	61106	10 : View List ['sk_OCSP_RESPID_value', 'WPACKET_allocate_bytes', 'sk_OCSP_RESPID_num', 'WPACKET_start_sub_packet_len__', 'WPACKET_close', 'WPACKET_put_bytes__', 'i2d_OCSP_RESPID', 'WPACKET_sub_allocate_bytes__', 'i2d_X509_EXTENSIONS', 'ossl_statem_fatal']	14662	61106	tls_construct_ctos_status_request	call site: 00000	/src/openssl111/ssl/statem/extensions_clnt.c:316
8526	8526	2 : View List ['SSL_use_certificate', 'SSL_use_PrivateKey']	8526	28302	tls_prepare_client_certificate	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:3510
7290	7290	2 : View List ['RAND_DRBG_bytes', 'RAND_DRBG_get0_private']	7290	7290	RAND_priv_bytes	call site: 03163	/src/openssl111/crypto/rand/rand_lib.c:930
6958	6958	2 : View List ['OPENSSL_die', 'evp_EncryptDecryptUpdate']	6958	13870	EVP_DecryptUpdate	call site: 02158	/src/openssl111/crypto/evp/evp_enc.c:494
6928	21688	3 : View List ['bn_mul_mont_fixed_top', 'MOD_EXP_CTIME_COPY_TO_PREBUF', 'MOD_EXP_CTIME_COPY_FROM_PREBUF']	6930	25333	BN_mod_exp_mont_consttime	call site: 00000	/src/openssl111/crypto/bn/bn_exp.c:920
5391	5545	2 : View List ['EC_GROUP_free', 'EC_GROUP_new_from_ecpkparameters']	5391	16130	d2i_ECPKParameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:960
5036	5036	1 : View List ['ssl_validate_ct']	5036	5036	tls_process_initial_server_flight	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:2847
4707	4707	1 : View List ['srp_generate_client_master_secret']	4707	4717	tls_client_key_exchange_post_work	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:3381
4677	4677	1 : View List ['ssl_check_srvr_ecc_cert_and_alg']	4677	8336	ssl3_check_cert_and_algorithm	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:3612
4597	8256	2 : View List ['SRP_Calc_A_param', 'ossl_statem_fatal']	4597	13572	tls_process_server_done	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:2868

Runtime coverage analysis

Covered functions

2183

Functions that are reachable but not covered

587

Reachable functions

1442

Percentage of reachable functions covered

59.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/client.c	2
openssl111/ssl/methods.c	1
openssl111/ssl/ssl_lib.c	32
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	46
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	14
openssl111/crypto/async/async.c	17
openssl111/crypto/async/async_local.h	4
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	3
openssl111/crypto/rand/drbg_lib.c	20
openssl111/crypto/rand/rand_lib.c	17
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	2
openssl111/crypto/rand/rand_unix.c	6
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	9
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	17
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	6
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	7
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	29
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	5
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	11
openssl111/include/openssl/x509.h	9
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	4
openssl111/crypto/asn1/tasn_typ.c	7
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	3
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	11
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	6
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/ssl/ssl_init.c	8
openssl111/ssl/ssl_ciph.c	23
openssl111/include/openssl/ssl.h	15
openssl111/crypto/comp/comp_lib.c	3
openssl111/ssl/s3_lib.c	3
openssl111/ssl/ssl_err.c	1
openssl111/ssl/ssl_cert.c	14
openssl111/ssl/ssl_local.h	6
openssl111/crypto/x509/x509_lu.c	8
openssl111/include/openssl/x509_vfy.h	7
openssl111/crypto/x509/x509_cmp.c	5
openssl111/crypto/x509/x_name.c	2
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/x509/x509_vpm.c	10
openssl111/crypto/ct/ct_log.c	3
openssl111/include/openssl/ct.h	3
openssl111/crypto/rand/drbg_ctr.c	1
openssl111/ssl/tls_srp.c	2
openssl111/ssl/ssl_mcnf.c	2
openssl111/ssl/ssl_conf.c	13
openssl111/ssl/ssl_rsa.c	5
openssl111/crypto/x509/x_all.c	1
openssl111/crypto/asn1/a_d2i_fp.c	2
openssl111/crypto/x509/x_pubkey.c	2
openssl111/crypto/x509/x_x509.c	1
openssl111/ssl/ssl_sess.c	7
openssl111/crypto/x509/x_crl.c	1
openssl111/ssl/statem/extensions_cust.c	4
openssl111/ssl/record/rec_layer_s3.c	6
openssl111/ssl/record/ssl3_record.c	2
openssl111/crypto/x509/x509_set.c	1
openssl111/ssl/statem/statem.c	4
openssl111/ssl/record/ssl3_buffer.c	3
openssl111/ssl/record/rec_layer_d1.c	1
openssl111/ssl/pqueue.c	2
openssl111/ssl/statem/statem_lib.c	1
openssl111/include/internal/dane.h	1
openssl111/crypto/x509/x_exten.c	1
openssl111/include/openssl/ocsp.h	1
openssl111/crypto/ocsp/ocsp_asn.c	1
openssl111/crypto/ct/ct_sct.c	2

Fuzzer: server_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2158	51.4%
gold	[1:9]	778	18.5%
yellow	[10:29]	48	1.14%
greenyellow	[30:49]	17	0.40%
lawngreen	50+	1192	28.4%
All colors	4193	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
26168	29743	8 : View List ['PKCS8_PRIV_KEY_INFO_free', 'EVP_PKEY_free', 'd2i_X509_SIG', 'PKCS8_decrypt', 'PEM_def_callback', 'OPENSSL_cleanse', 'EVP_PKCS82PKEY', 'X509_SIG_free']	26168	36813	PEM_read_bio_PrivateKey	call site: 02444	/src/openssl111/crypto/pem/pem_pkey.c:51
19882	19892	6 : View List ['X509v3_addr_validate_path', 'X509v3_asid_validate_path', 'verify_cb_cert', 'X509_chain_check_suiteb', 'internal_verify', 'check_name_constraints']	19882	19892	verify_chain	call site: 00000	/src/openssl111/crypto/x509/x509_vfy.c:222
14188	24886	11 : View List ['ssl_dh_to_pkey', 'DH_get0_key', 'EVP_PKEY_get0_DH', 'EVP_PKEY_new', 'EVP_PKEY_security_bits', 'EVP_PKEY_assign', 'DH_free', 'ssl_generate_pkey', 'ssl_get_auto_dh', 'ssl_security', 'DH_get0_pqg']	14190	168837	tls_construct_server_key_exchange	call site: 00000	/src/openssl111/ssl/statem/statem_srvr.c:2527
13447	68493	14 : View List ['get_issuer', 'sk_X509_delete_ptr', 'X509_up_ref', 'ERR_put_error', 'find_issuer', 'check_dane_issuer', 'X509_free', 'cert_self_signed', 'sk_X509_push.19237', 'X509_cmp', 'ossl_assert_int.19244', 'sk_X509_pop.19246', 'sk_X509_set', 'sk_X509_value.19226']	17543	82253	build_chain	call site: 00000	/src/openssl111/crypto/x509/x509_vfy.c:3203
11134	14738	4 : View List ['dtls1_clear_received_buffer', 'SSL_CTX_remove_session', 'ssl3_cleanup_key_block', 'ssl_update_cache']	11134	14742	tls_finish_handshake	call site: 00000	/src/openssl111/ssl/statem/statem_lib.c:1073
10501	13975	3 : View List ['PROXY_CERT_INFO_EXTENSION_free', 'X509_get_ext_by_NID', 'ASN1_INTEGER_get']	10501	72601	x509v3_cache_extensions	call site: 03604	/src/openssl111/crypto/x509v3/v3_purp.c:425
7528	14935	9 : View List ['X509_up_ref', 'X509_NAME_cmp', 'X509_OBJECT_idx_by_subject', 'X509_get_subject_name', 'x509_check_cert_time', 'sk_X509_OBJECT_num', 'X509_STORE_lock', 'X509_STORE_unlock', 'sk_X509_OBJECT_value']	7528	22077	X509_STORE_CTX_get1_issuer	call site: 00000	/src/openssl111/crypto/x509/x509_lu.c:689
7372	85955	13 : View List ['BN_sub_word', 'BN_kronecker', 'BN_mod_lshift1_quick', 'BN_is_one', 'BN_mod_mul', 'BN_rshift1', 'BN_copy', 'BN_num_bits', 'BN_ucmp', 'BN_set_word', 'BN_priv_rand', 'BN_nnmod', 'BN_is_zero']	7372	141079	BN_mod_sqrt	call site: 00000	/src/openssl111/crypto/bn/bn_sqrt.c:85
7366	7368	5 : View List ['EVP_PKEY_id', 'sk_X509_NAME_num.1901', 'ssl_check_ca_name', 'sk_X509_value.1895', 'sk_X509_num.1896']	7366	7372	tls1_check_chain	call site: 00000	/src/openssl111/ssl/t1_lib.c:2340
7290	7290	2 : View List ['RAND_DRBG_bytes', 'RAND_DRBG_get0_private']	7290	7290	RAND_priv_bytes	call site: 03163	/src/openssl111/crypto/rand/rand_lib.c:930
7268	28127	10 : View List ['EVP_DecryptUpdate', 'ERR_put_error', 'EVP_DecryptFinal_ex', 'EVP_CIPHER_CTX_new', 'EVP_CIPHER_CTX_free', 'EVP_BytesToKey', 'PEM_def_callback', 'OPENSSL_cleanse', 'EVP_DecryptInit_ex', 'EVP_md5']	7268	28127	PEM_do_header	call site: 01898	/src/openssl111/crypto/pem/pem_lib.c:427
6963	6963	2 : View List ['tls1_set_sigalgs_list', 'tls1_set_groups_list']	6963	6963	SSL_CTX_ctrl	call site: 03492	/src/openssl111/ssl/ssl_lib.c:2313

Runtime coverage analysis

Covered functions

2161

Functions that are reachable but not covered

598

Reachable functions

1570

Percentage of reachable functions covered

61.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/server.c	2
openssl111/ssl/methods.c	1
openssl111/ssl/ssl_lib.c	36
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	46
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	14
openssl111/crypto/async/async.c	17
openssl111/crypto/async/async_local.h	4
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	3
openssl111/crypto/rand/drbg_lib.c	20
openssl111/crypto/rand/rand_lib.c	17
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	2
openssl111/crypto/rand/rand_unix.c	6
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	9
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	18
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	5
openssl111/crypto/objects/obj_xref.h	4
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	18
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	13
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	6
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	7
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	29
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	5
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	3
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	15
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	2
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	8
openssl111/crypto/evp/p_lib.c	19
openssl111/include/openssl/x509.h	14
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	11
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	4
openssl111/crypto/asn1/tasn_typ.c	7
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	3
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	11
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	6
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/ssl/ssl_init.c	8
openssl111/ssl/ssl_ciph.c	23
openssl111/include/openssl/ssl.h	15
openssl111/crypto/comp/comp_lib.c	3
openssl111/ssl/s3_lib.c	3
openssl111/ssl/ssl_err.c	1
openssl111/ssl/ssl_cert.c	16
openssl111/ssl/ssl_local.h	7
openssl111/crypto/x509/x509_lu.c	8
openssl111/include/openssl/x509_vfy.h	7
openssl111/crypto/x509/x509_cmp.c	9
openssl111/crypto/x509/x_name.c	5
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/x509/x509_vpm.c	10
openssl111/crypto/ct/ct_log.c	3
openssl111/include/openssl/ct.h	3
openssl111/crypto/rand/drbg_ctr.c	1
openssl111/ssl/tls_srp.c	2
openssl111/ssl/ssl_mcnf.c	2
openssl111/ssl/ssl_conf.c	13
openssl111/ssl/ssl_rsa.c	7
openssl111/crypto/x509/x_all.c	2
openssl111/crypto/asn1/a_d2i_fp.c	2
openssl111/crypto/x509/x_pubkey.c	2
openssl111/crypto/x509/x_x509.c	2
openssl111/ssl/ssl_sess.c	7
openssl111/crypto/x509/x_crl.c	1
openssl111/ssl/statem/extensions_cust.c	4
openssl111/ssl/t1_lib.c	11
openssl111/crypto/ec/ec_curve.c	1
openssl111/ssl/statem/statem_lib.c	1
openssl111/crypto/rsa/rsa_asn1.c	1
openssl111/crypto/x509v3/v3_purp.c	12
openssl111/crypto/asn1/a_digest.c	1
openssl111/crypto/x509/x509_set.c	6
openssl111/crypto/x509/x509_ext.c	4
openssl111/crypto/x509v3/v3_lib.c	6
openssl111/crypto/x509/x509_v3.c	5
openssl111/include/openssl/x509v3.h	8
openssl111/crypto/x509v3/v3_bcons.c	1
openssl111/crypto/x509v3/v3_pcia.c	1
openssl111/crypto/asn1/a_octet.c	1
openssl111/crypto/x509v3/v3_crld.c	1
openssl111/crypto/asn1/a_dup.c	1
openssl111/crypto/x509/x509name.c	1
openssl111/crypto/ec/ec_key.c	3
openssl111/crypto/pem/pem_all.c	4
openssl111/crypto/ec/ec_lib.c	3
openssl111/crypto/ec/ecp_nistz256.c	1
openssl111/crypto/ec/ecp_nistp224.c	1
openssl111/crypto/ec/ecp_nistp256.c	1
openssl111/crypto/ec/ecp_nistp521.c	1
openssl111/crypto/ec/ec_mult.c	1
openssl111/crypto/bn/bn_mont.c	1
openssl111/crypto/pem/pem_x509.c	1
openssl111/crypto/pem/pem_oth.c	1
openssl111/crypto/dsa/dsa_lib.c	2
openssl111/ssl/record/rec_layer_s3.c	6
openssl111/ssl/record/ssl3_record.c	2
openssl111/ssl/statem/statem.c	5
openssl111/ssl/record/ssl3_buffer.c	3
openssl111/ssl/record/rec_layer_d1.c	1
openssl111/ssl/pqueue.c	2
openssl111/include/internal/dane.h	1
openssl111/crypto/x509/x_exten.c	1
openssl111/include/openssl/ocsp.h	1
openssl111/crypto/ocsp/ocsp_asn.c	1
openssl111/crypto/ct/ct_sct.c	2

Fuzzer: asn1parse_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4434	86.7%
gold	[1:9]	353	6.90%
yellow	[10:29]	31	0.60%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	289	5.65%
All colors	5112	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	12431	15896	CONF_modules_load_file_ex	call site: 03829	/src/openssl30/crypto/conf/conf_mod.c:200
5603	5603	1 : View List ['ossl_asn1_template_free']	5603	5603	ossl_asn1_item_embed_free	call site: 02265	/src/openssl30/crypto/asn1/tasn_fre.c:48
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04515	/src/openssl30/crypto/conf/conf_mod.c:219
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 01687	/src/openssl111/crypto/bn/bn_shift.c:85
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00981	/src/openssl111/crypto/engine/eng_lib.c:118
45	45	3 : View List ['lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free', 'lh_ADDED_OBJ_set_down_load']	45	45	ossl_obj_cleanup_int	call site: 04993	/src/openssl30/crypto/objects/obj_dat.c:155
14	14	1 : View List ['bio_call_callback']	14	14	bio_write_intern	call site: 05039	/src/openssl111/crypto/bio/bio_lib.c:348
11	11	1 : View List ['lh_ADDED_OBJ_retrieve']	11	35	OBJ_obj2nid	call site: 01565	/src/openssl111/crypto/objects/obj_dat.c:331
6	3459	2 : View List ['BN_set_negative', 'BN_set_word']	6	3459	BN_sub_word	call site: 01675	/src/openssl111/crypto/bn/bn_word.c:145
0	16552	4 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ASN1_INTEGER_free']	0	16552	ossl_c2i_ASN1_INTEGER	call site: 03603	/src/openssl30/crypto/asn1/a_int.c:306
0	16548	4 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ASN1_OBJECT_free']	0	16548	ossl_c2i_ASN1_OBJECT	call site: 03587	/src/openssl30/crypto/asn1/a_object.c:311
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	asn1_item_ex_d2i_intern	call site: 03484	/src/openssl30/crypto/asn1/tasn_dec.c:114

Runtime coverage analysis

Covered functions

369

Functions that are reachable but not covered

1046

Reachable functions

1382

Percentage of reachable functions covered

24.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/asn1parse.c	1
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	16
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/bio/bio_dump.c	4

Fuzzer: cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5628	63.6%
gold	[1:9]	1083	12.2%
yellow	[10:29]	155	1.75%
greenyellow	[30:49]	74	0.83%
lawngreen	50+	1905	21.5%
All colors	8845	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44115	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44115	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:850
42813	189126	22 : View List ['OSSL_CRMF_CERTTEMPLATE_get0_issuer', 'OSSL_CMP_CTX_snprint_PKIStatus', 'ossl_check_const_OSSL_CRMF_CERTID_sk_type', 'OSSL_CRMF_CERTTEMPLATE_get0_serialNumber', 'OSSL_CRMF_CERTID_get0_serialNumber', 'ASN1_INTEGER_cmp', 'ossl_cmp_revrepcontent_get_CertId', 'sk_OSSL_CMP_REVDETAILS_value', 'ossl_cmp_print_log', 'send_receive_check', 'ossl_check_const_X509_CRL_sk_type', 'ERR_new', 'ERR_add_error_data', 'X509_NAME_cmp', 'ossl_check_const_OSSL_CMP_PKISI_sk_type', 'ossl_cmp_pkisi_get_status', 'OPENSSL_sk_num', 'save_statusInfo', 'ossl_cmp_revrepcontent_get_pkisi', 'ERR_set_debug', 'ERR_set_error', 'OSSL_CRMF_CERTID_get0_issuer']	42813	200990	OSSL_CMP_exec_RR_ses	call site: 08531	/src/openssl/crypto/cmp/cmp_client.c:785
35717	59180	11 : View List ['OSSL_CRMF_POPOPRIVKEY_new', 'ASN1_INTEGER_set', 'ASN1_INTEGER_new', 'ASN1_NULL_new', 'OSSL_CRMF_POPOSIGNINGKEY_free', 'ERR_set_debug', 'ERR_set_error', 'OSSL_CRMF_POPO_new', 'OSSL_CRMF_POPOSIGNINGKEY_new', 'create_popo_signature', 'ERR_new']	35717	71044	OSSL_CRMF_MSG_create_popo	call site: 06164	/src/openssl/crypto/crmf/crmf_lib.c:405
24317	40855	6 : View List ['OSSL_CMP_CTX_set_option', 'ERR_set_debug', 'ERR_set_error', 'ossl_cmp_hdr_has_implicitConfirm', 'ossl_cmp_certrep_new', 'ERR_new']	24317	62228	process_cert_request	call site: 08647	/src/openssl/crypto/cmp/cmp_server.c:223
20170	20170	4 : View List ['time', 'ASN1_TIME_adj', 'ASN1_TIME_free', 'OSSL_CRMF_MSG_set0_validity']	50345	91063	OSSL_CMP_CTX_setup_CRM	call site: 06004	/src/openssl/crypto/cmp/cmp_msg.c:309
19335	116682	15 : View List ['sk_OSSL_CMP_POLLREP_num', 'OSSL_sleep', 'CRYPTO_free', 'ossl_cmp_print_log', 'ASN1_INTEGER_get_int64', 'send_receive_check', 'ERR_new', 'ossl_cmp_pollReq_new', 'ossl_sk_ASN1_UTF8STRING2text', 'ERR_add_error_data', 'OSSL_CMP_MSG_get_bodytype', 'time', 'ERR_set_debug', 'ERR_set_error', 'ossl_cmp_pollrepcontent_get0_pollrep']	19335	146342	poll_for_response	call site: 08360	/src/openssl/crypto/cmp/cmp_client.c:261
18205	18205	2 : View List ['verify_signature', 'ossl_cmp_ctx_set1_validatedSrvCert']	18205	46439	OSSL_CMP_validate_msg	call site: 07779	/src/openssl/crypto/cmp/cmp_vfy.c:617
14440	40367	7 : View List ['ossl_cmp_msg_add_extraCerts', 'set_senderKID', 'X509_check_private_key', 'sig_algor', 'ossl_cmp_calc_protection', 'X509_get0_subject_key_id', 'ossl_cmp_general_name_is_NULL_DN']	14440	89981	ossl_cmp_msg_protect	call site: 06370	/src/openssl/crypto/cmp/cmp_protect.c:269
13974	13974	1 : View List ['ossl_cmp_exchange_error']	13974	13974	OSSL_CMP_try_certreq	call site: 08500	/src/openssl/crypto/cmp/cmp_client.c:713
13416	19348	2 : View List ['send_receive_check', 'OSSL_CMP_MSG_free']	13416	19348	initial_certreq	call site: 05716	/src/openssl/crypto/cmp/cmp_client.c:686
13416	16868	2 : View List ['send_receive_check', 'OPENSSL_sk_new_null']	13416	28732	OSSL_CMP_exec_GENM_ses	call site: 08615	/src/openssl/crypto/cmp/cmp_client.c:906
12843	12843	1 : View List ['check_msg_find_cert']	12843	18691	OSSL_CMP_validate_msg	call site: 07779	/src/openssl/crypto/cmp/cmp_vfy.c:618

Runtime coverage analysis

Covered functions

2671

Functions that are reachable but not covered

1399

Reachable functions

2967

Percentage of reachable functions covered

52.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/cmp.c	6
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/bio_lib.c	19
openssl/crypto/mem.c	7
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	5
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	23
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	18
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	35
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	31
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	15
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	29
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	19
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	8
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	8
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	42
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	21
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	29
openssl/crypto/params.c	49
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	2
openssl/crypto/asn1/tasn_typ.c	23
openssl/crypto/asn1/a_octet.c	3
openssl/crypto/asn1/a_type.c	3
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	5
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	110
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	3
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	5
openssl/crypto/passphrase.c	10
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	22
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	10
openssl/crypto/evp/keymgmt_lib.c	15
openssl/crypto/evp/p_lib.c	33
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	10
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	20
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	11
openssl/crypto/evp/signature.c	12
openssl/crypto/evp/exchange.c	3
openssl/crypto/evp/kem.c	3
openssl/crypto/evp/asymcipher.c	11
openssl/crypto/evp/ctrl_params_translate.c	13
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	10
openssl/crypto/asn1/a_bitstr.c	5
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	7
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	14
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	18
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	18
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	12
openssl/crypto/objects/obj_xref.h	4
openssl/crypto/cmp/cmp_util.c	8
openssl/crypto/trace.c	2
openssl/crypto/cmp/cmp_msg.c	37
openssl/crypto/cmp/cmp_asn.c	32
openssl/crypto/asn1/a_d2i_fp.c	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/cmp/cmp_server.c	12
openssl/crypto/cmp/cmp_ctx.c	27
openssl/crypto/http/http_client.c	2
openssl/crypto/x509/x_x509.c	11
openssl/crypto/x509/x_name.c	10
openssl/crypto/x509/x509_lu.c	18
openssl/include/openssl/x509_vfy.h	9
openssl/crypto/x509/x_crl.c	4
openssl/crypto/x509/x509_vpm.c	14
openssl/crypto/x509/t_x509.c	6
openssl/include/openssl/cmp.h	8
openssl/include/openssl/x509v3.h	14
openssl/crypto/x509/v3_genn.c	6
openssl/crypto/x509/x_exten.c	5
openssl/crypto/x509/v3_cpols.c	4
openssl/crypto/x509/x_req.c	4
openssl/crypto/asn1/a_i2d_fp.c	1
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/tasn_prn.c	9
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/a_utctm.c	2
openssl/crypto/asn1/a_time.c	14
openssl/crypto/o_time.c	6
openssl/crypto/asn1/a_gentm.c	3
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/asn1/a_strex.c	9
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/x509/x509_set.c	12
openssl/crypto/asn1/a_dup.c	1
openssl/crypto/cmp/cmp_client.c	13
openssl/crypto/cmp/cmp_hdr.c	16
openssl/crypto/x509/x509_cmp.c	19
openssl/crypto/x509/x509_req.c	5
openssl/crypto/x509/v3_skid.c	1
openssl/crypto/crmf/crmf_asn.c	29
openssl/crypto/cmp/cmp_local.h	12
openssl/crypto/x509/x509name.c	6
openssl/crypto/x509/x509_v3.c	13
openssl/crypto/crmf/crmf_lib.c	18
openssl/crypto/x509/x509_att.c	4
openssl/crypto/x509/v3_lib.c	6
openssl/crypto/x509/v3_conf.c	2
openssl/crypto/crmf/crmf_local.h	3
openssl/crypto/asn1/a_sign.c	2
openssl/crypto/asn1/x_algor.c	11
openssl/include/openssl/crmf.h	4
openssl/crypto/cmp/cmp_protect.c	6
openssl/crypto/crmf/crmf_pbm.c	2
openssl/crypto/x509/v3_purp.c	18
openssl/crypto/x509/x_all.c	4
openssl/crypto/asn1/a_digest.c	1
openssl/crypto/x509/x509_ext.c	6
openssl/crypto/x509/v3_bcons.c	2
openssl/crypto/x509/v3_pcia.c	2
openssl/crypto/x509/v3_crld.c	1
openssl/crypto/evp/mac_lib.c	10
openssl/crypto/evp/mac_meth.c	9
openssl/crypto/x509/x509_vfy.c	57
openssl/crypto/x509/pcy_tree.c	14
openssl/crypto/x509/pcy_node.c	7
openssl/crypto/x509/pcy_local.h	8
openssl/crypto/x509/pcy_data.c	2
openssl/crypto/asn1/a_verify.c	2
openssl/crypto/rsa/rsa_ameth.c	3
openssl/crypto/rsa/rsa_backend.c	2
openssl/crypto/rsa/rsa_asn1.c	2
openssl/crypto/asn1/asn_pack.c	1
openssl/crypto/rsa/rsa_pss.c	3
openssl/crypto/rsa/rsa_lib.c	4
openssl/crypto/x509/x509cset.c	4
openssl/crypto/x509/pcy_cache.c	6
openssl/crypto/x509/pcy_map.c	1
openssl/crypto/x509/v3_pmaps.c	2
openssl/crypto/x509/v3_pcons.c	2
openssl/crypto/x509/pcy_lib.c	1
openssl/include/internal/dane.h	2
openssl/crypto/encode_decode/encoder_pkey.c	7
openssl/crypto/encode_decode/encoder_lib.c	19
openssl/crypto/x509/x509_trust.c	5
openssl/crypto/cmp/cmp_vfy.c	18
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/x509/v3_prn.c	4
openssl/crypto/asn1/a_print.c	1
openssl/crypto/x509/x_x509a.c	5
openssl/crypto/cmp/cmp_status.c	7
openssl/crypto/sleep.c	1

Fuzzer: crl_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3645	67.6%
gold	[1:9]	876	16.2%
yellow	[10:29]	73	1.35%
greenyellow	[30:49]	13	0.24%
lawngreen	50+	779	14.4%
All colors	5386	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20741	29759	13 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'DSO_new', 'DSO_merge', 'DSO_free', 'CRYPTO_free', 'get_provider_store', 'DSO_ctrl', 'DSO_load', 'ossl_safe_getenv', 'CRYPTO_strdup', 'DSO_bind_func', 'DSO_convert_filename']	24200	99389	provider_init	call site: 01820	/src/openssl30/crypto/provider_core.c:850
10374	13837	5 : View List ['CRYPTO_zalloc', 'ENGINE_get_digest', 'ENGINE_finish', 'ENGINE_init', 'EVP_PKEY_CTX_ctrl']	10374	68989	evp_md_init_internal	call site: 03295	/src/openssl30/crypto/evp/digest.c:222
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	12431	15896	CONF_modules_load_file_ex	call site: 03640	/src/openssl30/crypto/conf/conf_mod.c:200
7508	7508	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	7508	24046	evp_md_init_internal	call site: 02696	/src/openssl30/crypto/evp/digest.c:152
5521	5521	1 : View List ['parse_oct']	5521	5521	parse_value	call site: 04040	/src/openssl30/crypto/property/property_parse.c:244
5518	5518	1 : View List ['parse_hex']	5518	5518	parse_value	call site: 04031	/src/openssl30/crypto/property/property_parse.c:241
5517	5517	1 : View List ['parse_string']	5517	5517	parse_value	call site: 04021	/src/openssl30/crypto/property/property_parse.c:231
5517	5517	1 : View List ['parse_number']	5517	5517	parse_value	call site: 04045	/src/openssl30/crypto/property/property_parse.c:247
5514	11031	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	5514	11031	ossl_provider_up_ref	call site: 02005	/src/openssl30/crypto/provider_core.c:495
5514	5514	1 : View List ['ossl_provider_free_parent']	5514	5514	provider_deactivate	call site: 01901	/src/openssl30/crypto/provider_core.c:1103
3464	3468	3 : View List ['CRYPTO_free', 'ERR_put_error', 'sk_X509_NAME_ENTRY_free']	3464	3468	x509_name_ex_new	call site: 00000	/src/openssl111/crypto/x509/x_name.c:98
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04349	/src/openssl30/crypto/conf/conf_mod.c:219

Runtime coverage analysis

Covered functions

1313

Functions that are reachable but not covered

660

Reachable functions

1492

Percentage of reachable functions covered

55.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/crl.c	1
openssl30/crypto/x509/x_crl.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	5
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	17
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	17
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	4
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	5
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/x509/t_crl.c	2
openssl30/crypto/x509/x509cset.c	10
openssl30/crypto/x509/t_x509.c	2
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/asn1/a_strex.c	8
openssl30/crypto/x509/x_name.c	1
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/x509/x509name.c	5
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/asn1/a_time.c	6
openssl30/crypto/o_time.c	4
openssl30/crypto/x509/v3_prn.c	4
openssl30/crypto/x509/x509_v3.c	3
openssl30/crypto/x509/v3_lib.c	4
openssl30/include/openssl/x509v3.h	2
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/asn1/f_int.c	1

Fuzzer: conf_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4521	89.8%
gold	[1:9]	310	6.16%
yellow	[10:29]	27	0.53%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	168	3.33%
All colors	5031	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3455	3455	1 : View List ['ERR_put_error']	3455	3455	mem_write	call site: 00000	/src/openssl111/crypto/bio/bss_mem.c:227
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_grow	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:98
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_grow_clean	call site: 03542	/src/openssl111/crypto/buffer/buffer.c:136
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00981	/src/openssl111/crypto/engine/eng_lib.c:118
104	104	1 : View List ['sec_alloc_realloc']	3559	3559	BUF_MEM_grow	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:94
104	104	1 : View List ['sec_alloc_realloc']	3559	3559	BUF_MEM_grow_clean	call site: 03538	/src/openssl111/crypto/buffer/buffer.c:132
80	80	1 : View List ['CRYPTO_secure_clear_free']	80	84	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:48
45	45	3 : View List ['lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free', 'lh_ADDED_OBJ_set_down_load']	45	45	ossl_obj_cleanup_int	call site: 04992	/src/openssl30/crypto/objects/obj_dat.c:155
14	14	1 : View List ['bio_call_callback']	14	14	bio_write_intern	call site: 05022	/src/openssl111/crypto/bio/bio_lib.c:348
4	4	2 : View List ['__errno_location', 'free']	4	4	OPENSSL_DIR_read	call site: 00000	/src/openssl111/crypto/LPdir_unix.c:113
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	NCONF_new_ex	call site: 00004	/src/openssl30/crypto/conf/conf_lib.c:190

Runtime coverage analysis

Covered functions

333

Functions that are reachable but not covered

1043

Reachable functions

1303

Percentage of reachable functions covered

19.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/conf.c	1
openssl30/crypto/conf/conf_lib.c	12
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2

Fuzzer: conf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4690	89.1%
gold	[1:9]	388	7.37%
yellow	[10:29]	3	0.05%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	178	3.38%
All colors	5260	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 05095	/src/openssl/crypto/context.c:294
3455	3455	1 : View List ['ERR_put_error']	3455	3455	mem_write	call site: 00000	/src/openssl111/crypto/bio/bss_mem.c:227
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
80	94	3 : View List ['CRYPTO_free', 'CRYPTO_clear_free', 'CRYPTO_secure_clear_free']	80	94	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:45
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	16573	ossl_crypto_new_ex_data_ex	call site: 00873	/src/openssl30/crypto/ex_data.c:231
4	4	2 : View List ['__errno_location', 'free']	4	4	OPENSSL_DIR_read	call site: 00000	/src/openssl111/crypto/LPdir_unix.c:113
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	NCONF_new_ex	call site: 00004	/src/openssl30/crypto/conf/conf_lib.c:190
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	do_init_module_list_lock	call site: 00461	/src/openssl30/crypto/conf/conf_mod.c:102
0	5842	1 : View List ['ossl_provider_store_free']	0	5842	ossl_provider_store_new	call site: 04993	/src/openssl/crypto/provider_core.c:311
0	44	1 : View List ['ossl_property_string_data_free']	0	44	ossl_property_string_data_new	call site: 05006	/src/openssl/crypto/property/property_string.c:111
0	19	1 : View List ['ossl_threads_ctx_free']	0	19	ossl_threads_ctx_new	call site: 05042	/src/openssl/crypto/thread/internal.c:137
0	4	1 : View List ['CRYPTO_free']	0	4	ossl_prov_conf_ctx_new	call site: 00187	/src/openssl/crypto/provider_conf.c:38

Runtime coverage analysis

Covered functions

375

Functions that are reachable but not covered

1093

Reachable functions

1402

Percentage of reachable functions covered

22.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/conf.c	1
openssl/crypto/conf/conf_lib.c	12
openssl/crypto/conf/conf_def.c	1
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/err/err_mark.c	3
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4

Fuzzer: x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3455	59.2%
gold	[1:9]	963	16.5%
yellow	[10:29]	88	1.50%
greenyellow	[30:49]	16	0.27%
lawngreen	50+	1313	22.5%
All colors	5835	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44115	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44115	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:850
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 00402	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 04925	/src/openssl/crypto/context.c:294
5547	5547	1 : View List ['ossl_dh_key2buf']	5547	16795	dh_get_params	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:325
5525	5525	1 : View List ['OSSL_PARAM_BLD_push_int']	5525	5525	ossl_param_build_set_int	call site: 00000	/src/openssl30/crypto/param_build_set.c:25
5525	5525	1 : View List ['OSSL_PARAM_BLD_push_long']	5525	5525	ossl_param_build_set_long	call site: 00000	/src/openssl30/crypto/param_build_set.c:36
5524	5524	1 : View List ['OSSL_PARAM_BLD_push_utf8_string']	5524	5524	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:47
5523	5523	1 : View List ['OSSL_PARAM_BLD_push_octet_string']	5523	5523	ossl_param_build_set_octet_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:60
5521	5521	1 : View List ['parse_oct']	5521	5521	parse_value	call site: 04063	/src/openssl30/crypto/property/property_parse.c:244
5518	5518	1 : View List ['parse_hex']	5518	5518	parse_value	call site: 04055	/src/openssl30/crypto/property/property_parse.c:241

Runtime coverage analysis

Covered functions

2439

Functions that are reachable but not covered

852

Reachable functions

1968

Percentage of reachable functions covered

56.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/x509.c	1
openssl/crypto/x509/x_x509.c	5
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	5
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	4
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	17
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	17
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	2
openssl/crypto/passphrase.c	10
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	10
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	24
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	3
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	8
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	18
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	9
openssl/crypto/objects/obj_xref.h	4
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/x509/t_x509.c	5
openssl/crypto/x509/x509_set.c	7
openssl/crypto/x509/x509_cmp.c	5
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/asn1/a_strex.c	8
openssl/crypto/x509/x_name.c	1
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/x509/x509name.c	5
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/asn1/a_time.c	4
openssl/crypto/o_time.c	4
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/encode_decode/encoder_pkey.c	7
openssl/crypto/encode_decode/encoder_lib.c	18
openssl/crypto/x509/v3_prn.c	4
openssl/crypto/x509/x509_v3.c	3
openssl/crypto/x509/v3_lib.c	4
openssl/include/openssl/x509v3.h	2
openssl/crypto/asn1/a_print.c	1
openssl/crypto/x509/x_x509a.c	5

Fuzzer: bndiv_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4619	89.0%
gold	[1:9]	338	6.51%
yellow	[10:29]	36	0.69%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	189	3.64%
All colors	5187	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	BN_CTX_new_ex	call site: 00000	/src/openssl30/crypto/bn/bn_ctx.c:122
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	do_init_module_list_lock	call site: 03876	/src/openssl30/crypto/conf/conf_mod.c:102
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	ossl_crypto_new_ex_data_ex	call site: 00185	/src/openssl30/crypto/ex_data.c:242
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05154	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 05036	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05028	/src/openssl111/crypto/bn/bn_div.c:224
3453	3453	1 : View List ['BN_set_word']	3453	3453	BN_add	call site: 05154	/src/openssl111/crypto/bn/bn_add.c:29
3453	3453	1 : View List ['BN_set_word']	3453	3453	bn_rshift_fixed_top	call site: 05055	/src/openssl111/crypto/bn/bn_shift.c:186
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00981	/src/openssl111/crypto/engine/eng_lib.c:118
45	45	3 : View List ['lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free', 'lh_ADDED_OBJ_set_down_load']	45	45	ossl_obj_cleanup_int	call site: 04992	/src/openssl30/crypto/objects/obj_dat.c:155
6	6	1 : View List ['bn_mul_comba4']	6	18	bn_mul_recursive	call site: 05117	/src/openssl111/crypto/bn/bn_mul.c:244
0	39	1 : View List ['property_string_data_free']	0	39	property_string_data_new	call site: 00000	/src/openssl30/crypto/property/property_string.c:103

Runtime coverage analysis

Covered functions

267

Functions that are reachable but not covered

1085

Reachable functions

1339

Percentage of reachable functions covered

18.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/bndiv.c	1
openssl30/crypto/bn/bn_lib.c	30
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	3
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	7
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/bn/bn_div.c	3
openssl30/crypto/bn/bn_ctx.c	7
openssl30/crypto/bn/bn_mul.c	6
openssl30/crypto/bn/bn_add.c	3
openssl30/crypto/bn/bn_print.c	2

Fuzzer: x509_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3299	58.8%
gold	[1:9]	866	15.4%
yellow	[10:29]	121	2.15%
greenyellow	[30:49]	23	0.41%
lawngreen	50+	1295	23.1%
All colors	5604	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44113	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44113	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:854
20741	29759	13 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'DSO_new', 'DSO_merge', 'DSO_free', 'CRYPTO_free', 'get_provider_store', 'DSO_ctrl', 'DSO_load', 'ossl_safe_getenv', 'CRYPTO_strdup', 'DSO_bind_func', 'DSO_convert_filename']	24200	99389	provider_init	call site: 01820	/src/openssl30/crypto/provider_core.c:850
10374	13837	5 : View List ['CRYPTO_zalloc', 'ENGINE_get_digest', 'ENGINE_finish', 'ENGINE_init', 'EVP_PKEY_CTX_ctrl']	10374	68989	evp_md_init_internal	call site: 03295	/src/openssl30/crypto/evp/digest.c:222
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 03640	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
7508	7508	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	7508	24046	evp_md_init_internal	call site: 02696	/src/openssl30/crypto/evp/digest.c:152
5547	5547	1 : View List ['ossl_dh_key2buf']	5547	16795	dh_get_params	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:325
5531	5531	1 : View List ['OSSL_PARAM_BLD_push_BN']	5531	5531	ossl_param_build_set_bn	call site: 00000	/src/openssl30/crypto/param_build_set.c:87
5525	5525	1 : View List ['OSSL_PARAM_BLD_push_int']	5525	5525	ossl_param_build_set_int	call site: 00000	/src/openssl30/crypto/param_build_set.c:25
5524	5524	1 : View List ['OSSL_PARAM_BLD_push_utf8_string']	5524	5524	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:47
5523	5523	1 : View List ['OSSL_PARAM_BLD_push_octet_string']	5523	5523	ossl_param_build_set_octet_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:60

Runtime coverage analysis

Covered functions

2398

Functions that are reachable but not covered

820

Reachable functions

1879

Percentage of reachable functions covered

56.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/x509.c	1
openssl30/crypto/x509/x_x509.c	5
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	5
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	17
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	2
openssl30/crypto/passphrase.c	10
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	17
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	10
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	24
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	3
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	8
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	4
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	18
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	5
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/x509/t_x509.c	5
openssl30/crypto/x509/x509_set.c	7
openssl30/crypto/x509/x509_cmp.c	5
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/asn1/a_strex.c	8
openssl30/crypto/x509/x_name.c	1
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/x509/x509name.c	5
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/asn1/a_time.c	4
openssl30/crypto/o_time.c	4
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/encode_decode/encoder_pkey.c	7
openssl30/crypto/encode_decode/encoder_lib.c	17
openssl30/crypto/x509/v3_prn.c	4
openssl30/crypto/x509/x509_v3.c	3
openssl30/crypto/x509/v3_lib.c	4
openssl30/include/openssl/x509v3.h	2
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/x509/x_x509a.c	5

Fuzzer: bignum_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4805	85.0%
gold	[1:9]	340	6.01%
yellow	[10:29]	35	0.61%
greenyellow	[30:49]	8	0.14%
lawngreen	50+	464	8.20%
All colors	5652	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	BN_CTX_new_ex	call site: 05024	/src/openssl30/crypto/bn/bn_ctx.c:122
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	do_init_module_list_lock	call site: 03875	/src/openssl30/crypto/conf/conf_mod.c:102
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	ossl_crypto_new_ex_data_ex	call site: 00184	/src/openssl30/crypto/ex_data.c:242
6928	45323	9 : View List ['BN_div', 'BN_lshift1', 'BN_mul_word', 'BN_num_bits', 'BN_mul', 'BN_set_word', 'BN_lshift', 'BN_is_word', 'BN_add']	6928	73297	int_bn_mod_inverse	call site: 05242	/src/openssl111/crypto/bn/bn_gcd.c:260
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 05087	/src/openssl111/crypto/bn/bn_gcd.c:213
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05216	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 05057	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05104	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_MONT_CTX_new	call site: 05064	/src/openssl111/crypto/bn/bn_mont.c:232
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 01684	/src/openssl111/crypto/bn/bn_shift.c:85
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_rshift	call site: 05248	/src/openssl111/crypto/bn/bn_shift.c:154
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00980	/src/openssl111/crypto/engine/eng_lib.c:118

Runtime coverage analysis

Covered functions

320

Functions that are reachable but not covered

1110

Reachable functions

1421

Percentage of reachable functions covered

21.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/bignum.c	1
openssl30/crypto/bn/bn_lib.c	39
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	6
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	6
openssl30/crypto/bn/asm/x86_64-gcc.c	10
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/bn/bn_ctx.c	11
openssl30/crypto/bn/bn_exp.c	9
openssl30/crypto/bn/bn_mont.c	10
openssl30/crypto/bn/bn_gcd.c	3
openssl30/crypto/bn/bn_mod.c	2
openssl30/crypto/bn/bn_div.c	3
openssl30/crypto/bn/bn_mul.c	6
openssl30/crypto/bn/bn_add.c	4
openssl30/crypto/bn/bn_sqr.c	4
openssl30/crypto/bn/rsaz_exp.c	2
openssl30/crypto/bn/rsaz_exp.h	2
openssl30/crypto/bn/bn_recp.c	6
openssl30/crypto/bn/bn_print.c	2

Fuzzer: ct_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4615	88.0%
gold	[1:9]	315	6.00%
yellow	[10:29]	28	0.53%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	280	5.34%
All colors	5243	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5603	5603	1 : View List ['ossl_asn1_template_free']	5603	5603	ossl_asn1_item_embed_free	call site: 02268	/src/openssl30/crypto/asn1/tasn_fre.c:48
3455	3465	3 : View List ['CRYPTO_free', 'ERR_put_error', 'CRYPTO_malloc']	3455	3465	i2o_SCT_signature	call site: 05168	/src/openssl111/crypto/ct/ct_oct.c:176
3455	3461	2 : View List ['CRYPTO_malloc', 'ERR_put_error']	3455	6928	i2o_SCT	call site: 05164	/src/openssl111/crypto/ct/ct_oct.c:223
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	ossl_asn1_time_from_tm	call site: 05101	/src/openssl30/crypto/asn1/a_time.c:285
3455	3455	1 : View List ['ERR_put_error']	3455	3455	asn1_collect	call site: 04894	/src/openssl111/crypto/asn1/tasn_dec.c:1052
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_grow_clean	call site: 04903	/src/openssl111/crypto/buffer/buffer.c:136
3455	3455	1 : View List ['ERR_put_error']	3455	3455	i2o_SCT_LIST	call site: 05154	/src/openssl111/crypto/ct/ct_oct.c:333
3455	3455	1 : View List ['ERR_put_error']	3455	3455	SCT_new	call site: 05032	/src/openssl111/crypto/ct/ct_sct.c:26
3455	3455	1 : View List ['ERR_put_error']	3455	3455	SCT_set1_signature	call site: 05040	/src/openssl111/crypto/ct/ct_sct.c:186
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00984	/src/openssl111/crypto/engine/eng_lib.c:118
104	104	1 : View List ['sec_alloc_realloc']	3559	3559	BUF_MEM_grow_clean	call site: 04902	/src/openssl111/crypto/buffer/buffer.c:132
45	45	3 : View List ['lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free', 'lh_ADDED_OBJ_set_down_load']	45	45	ossl_obj_cleanup_int	call site: 04828	/src/openssl30/crypto/objects/obj_dat.c:155

Runtime coverage analysis

Covered functions

330

Functions that are reachable but not covered

1116

Reachable functions

1433

Percentage of reachable functions covered

22.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/ct.c	1
openssl30/crypto/ct/ct_oct.c	8
openssl30/crypto/asn1/tasn_typ.c	14
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	4
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/asn1_lib.c	14
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/include/openssl/ct.h	3
openssl30/crypto/ct/ct_sct.c	7
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/ct/ct_prn.c	4
openssl30/crypto/ct/ct_log.c	2
openssl30/crypto/bio/bio_dump.c	1
openssl30/crypto/asn1/a_gentm.c	5
openssl30/crypto/o_time.c	5
openssl30/crypto/asn1/a_time.c	8
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3

Fuzzer: bignum

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5146	87.3%
gold	[1:9]	260	4.41%
yellow	[10:29]	11	0.18%
greenyellow	[30:49]	3	0.05%
lawngreen	50+	472	8.01%
All colors	5892	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	BN_CTX_new_ex	call site: 05253	/src/openssl30/crypto/bn/bn_ctx.c:122
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	do_init_module_list_lock	call site: 00480	/src/openssl30/crypto/conf/conf_mod.c:102
6928	45323	9 : View List ['BN_div', 'BN_lshift1', 'BN_mul_word', 'BN_num_bits', 'BN_mul', 'BN_set_word', 'BN_lshift', 'BN_is_word', 'BN_add']	6928	73297	int_bn_mod_inverse	call site: 05471	/src/openssl111/crypto/bn/bn_gcd.c:260
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 05312	/src/openssl111/crypto/bn/bn_gcd.c:213
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05442	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05330	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_MONT_CTX_new	call site: 05287	/src/openssl111/crypto/bn/bn_mont.c:232
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 00670	/src/openssl111/crypto/bn/bn_shift.c:85
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_rshift	call site: 05479	/src/openssl111/crypto/bn/bn_shift.c:154
6	6	1 : View List ['bn_mul_comba4']	6	18	bn_mul_recursive	call site: 05405	/src/openssl111/crypto/bn/bn_mul.c:244
0	3556	1 : View List ['BN_sqr']	0	7110	BN_mod_mul	call site: 05849	/src/openssl111/crypto/bn/bn_mod.c:206
0	3463	2 : View List ['BN_sub_word', 'BN_is_zero']	0	3463	BN_add_word	call site: 00652	/src/openssl111/crypto/bn/bn_word.c:113

Runtime coverage analysis

Covered functions

271

Functions that are reachable but not covered

1253

Reachable functions

1522

Percentage of reachable functions covered

17.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/bignum.c	1
openssl/crypto/bn/bn_lib.c	44
openssl/crypto/mem.c	7
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	10
openssl/crypto/bn/bn_shift.c	6
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/bn/bn_ctx.c	14
openssl/crypto/bn/bn_exp.c	9
openssl/crypto/bn/bn_mont.c	10
openssl/crypto/bn/bn_gcd.c	3
openssl/crypto/bn/bn_mod.c	2
openssl/crypto/bn/bn_div.c	3
openssl/crypto/bn/bn_mul.c	6
openssl/crypto/bn/bn_add.c	4
openssl/crypto/bn/bn_sqr.c	4
openssl/crypto/bn/rsaz_exp.c	2
openssl/crypto/bn/rsaz_exp.h	2
openssl/include/internal/constant_time.h	6
openssl/crypto/bn/bn_recp.c	6
openssl/crypto/bn/bn_print.c	2

Fuzzer: cmp_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5927	65.5%
gold	[1:9]	1002	11.0%
yellow	[10:29]	171	1.89%
greenyellow	[30:49]	102	1.12%
lawngreen	50+	1844	20.3%
All colors	9046	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44113	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44113	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:854
42813	97903	21 : View List ['OSSL_CRMF_CERTTEMPLATE_get0_issuer', 'OSSL_CMP_CTX_snprint_PKIStatus', 'ossl_check_const_OSSL_CRMF_CERTID_sk_type', 'OSSL_CRMF_CERTTEMPLATE_get0_serialNumber', 'OSSL_CRMF_CERTID_get0_serialNumber', 'ASN1_INTEGER_cmp', 'ossl_cmp_revrepcontent_get_CertId', 'sk_OSSL_CMP_REVDETAILS_value', 'ossl_cmp_print_log', 'send_receive_check', 'ossl_check_const_X509_CRL_sk_type', 'ossl_cmp_rr_new', 'ERR_add_error_data', 'X509_NAME_cmp', 'ossl_check_const_OSSL_CMP_PKISI_sk_type', 'ossl_cmp_pkisi_get_status', 'OPENSSL_sk_num', 'save_statusInfo', 'OSSL_CMP_MSG_free', 'ossl_cmp_revrepcontent_get_pkisi', 'OSSL_CRMF_CERTID_get0_issuer']	42813	213669	OSSL_CMP_exec_RR_ses	call site: 08729	/src/openssl/crypto/cmp/cmp_client.c:779
28070	28120	10 : View List ['sk_X509_EXTENSION_value', 'EVP_sha1', 'setup_idp', 'X509_EXTENSION_get_object', 'X509_EXTENSION_get_critical', 'X509_CRL_get_ext_d2i', 'crl_set_issuers', 'X509_CRL_digest', 'OBJ_obj2nid', 'sk_X509_EXTENSION_num']	28070	28120	crl_cb	call site: 00000	/src/openssl111/crypto/x509/x_crl.c:164
24317	40855	6 : View List ['OSSL_CMP_CTX_set_option', 'ERR_set_debug', 'ERR_set_error', 'ossl_cmp_hdr_has_implicitConfirm', 'ossl_cmp_certrep_new', 'ERR_new']	36193	62228	process_cert_request	call site: 08849	/src/openssl/crypto/cmp/cmp_server.c:223
20741	29759	13 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'DSO_new', 'DSO_merge', 'DSO_free', 'CRYPTO_free', 'get_provider_store', 'DSO_ctrl', 'DSO_load', 'ossl_safe_getenv', 'CRYPTO_strdup', 'DSO_bind_func', 'DSO_convert_filename']	24200	99389	provider_init	call site: 01810	/src/openssl30/crypto/provider_core.c:850
13830	13830	3 : View List ['ENGINE_by_id', 'ENGINE_free', 'ENGINE_init']	13830	13830	load_common	call site: 00000	/src/openssl30/providers/common/provider_util.c:71
11085	16654	10 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_freedata', 'evp_keymgmt_util_export', 'evp_keymgmt_util_clear_operation_cache', 'CRYPTO_THREAD_write_lock', 'evp_keymgmt_util_cache_keydata', 'match_type', 'ossl_assert_int.27551', 'evp_keymgmt_util_find_operation_cache']	11085	16654	evp_keymgmt_util_export_to_provider	call site: 02886	/src/openssl30/crypto/evp/keymgmt_lib.c:117
10685	48234	4 : View List ['X509_build_chain', 'ossl_x509_add_cert_new', 'ossl_cmp_print_log', 'OSSL_CMP_CTX_print_errors']	10685	64643	ossl_cmp_msg_add_extraCerts	call site: 06251	/src/openssl/crypto/cmp/cmp_protect.c:139
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 03822	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
8141	8141	1 : View List ['X509_self_signed']	8141	28149	X509_add_cert	call site: 06839	/src/openssl30/crypto/x509/x509_cmp.c:211

Runtime coverage analysis

Covered functions

2597

Functions that are reachable but not covered

1361

Reachable functions

2852

Percentage of reachable functions covered

52.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/cmp.c	6
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/bio_lib.c	19
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	32
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	5
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	20
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	17
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	35
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	24
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	13
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	42
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	27
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	46
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	20
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	3
openssl30/crypto/o_fopen.c	1
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	5
openssl30/crypto/passphrase.c	10
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	23
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	2
openssl30/crypto/asn1/tasn_typ.c	23
openssl30/crypto/asn1/asn1_lib.c	17
openssl30/crypto/asn1/a_octet.c	3
openssl30/crypto/asn1/a_type.c	3
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	24
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	7
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	115
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	10
openssl30/crypto/evp/keymgmt_lib.c	16
openssl30/crypto/evp/p_lib.c	38
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	10
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	20
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	11
openssl30/crypto/evp/signature.c	12
openssl30/crypto/evp/exchange.c	3
openssl30/crypto/evp/kem.c	3
openssl30/crypto/evp/asymcipher.c	10
openssl30/crypto/evp/ctrl_params_translate.c	13
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	10
openssl30/crypto/asn1/a_bitstr.c	5
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	7
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	13
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	2
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	18
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	8
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	18
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	8
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	8
openssl30/crypto/trace.c	2
openssl30/crypto/cmp/cmp_msg.c	35
openssl30/crypto/cmp/cmp_asn.c	38
openssl30/crypto/asn1/a_d2i_fp.c	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/cmp/cmp_server.c	12
openssl30/crypto/cmp/cmp_ctx.c	26
openssl30/crypto/http/http_client.c	2
openssl30/crypto/x509/x_x509.c	11
openssl30/crypto/x509/x_name.c	10
openssl30/crypto/x509/x509_lu.c	18
openssl30/include/openssl/x509_vfy.h	9
openssl30/crypto/x509/x_crl.c	4
openssl30/crypto/x509/x509_vpm.c	14
openssl30/include/openssl/cmp.h	8
openssl30/include/openssl/x509v3.h	19
openssl30/crypto/x509/v3_genn.c	8
openssl30/crypto/x509/x_exten.c	5
openssl30/crypto/x509/v3_cpols.c	4
openssl30/crypto/x509/x_req.c	4
openssl30/crypto/asn1/a_i2d_fp.c	1
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/tasn_prn.c	4
openssl30/crypto/x509/x509_set.c	14
openssl30/crypto/asn1/a_dup.c	1
openssl30/crypto/cmp/cmp_client.c	13
openssl30/crypto/cmp/cmp_hdr.c	17
openssl30/crypto/x509/x509_cmp.c	19
openssl30/crypto/asn1/a_gentm.c	2
openssl30/crypto/o_time.c	6
openssl30/crypto/asn1/a_time.c	12
openssl30/crypto/crmf/crmf_asn.c	28
openssl30/crypto/cmp/cmp_local.h	12
openssl30/crypto/x509/x509_req.c	5
openssl30/crypto/x509/x509name.c	9
openssl30/crypto/x509/x509_v3.c	13
openssl30/crypto/crmf/crmf_lib.c	18
openssl30/crypto/x509/x509_att.c	4
openssl30/crypto/x509/v3_lib.c	6
openssl30/crypto/x509/v3_conf.c	2
openssl30/crypto/crmf/crmf_local.h	3
openssl30/crypto/asn1/a_sign.c	2
openssl30/crypto/asn1/x_algor.c	9
openssl30/include/openssl/crmf.h	4
openssl30/crypto/cmp/cmp_protect.c	6
openssl30/crypto/crmf/crmf_pbm.c	2
openssl30/crypto/x509/v3_purp.c	20
openssl30/crypto/x509/x_all.c	4
openssl30/crypto/asn1/a_digest.c	1
openssl30/crypto/x509/x509_ext.c	6
openssl30/crypto/x509/v3_bcons.c	2
openssl30/crypto/x509/v3_pcia.c	2
openssl30/crypto/x509/v3_crld.c	1
openssl30/crypto/evp/mac_lib.c	10
openssl30/crypto/evp/mac_meth.c	9
openssl30/crypto/x509/x509_vfy.c	67
openssl30/crypto/x509/pcy_tree.c	14
openssl30/crypto/x509/pcy_node.c	7
openssl30/crypto/x509/pcy_local.h	7
openssl30/crypto/x509/pcy_data.c	2
openssl30/crypto/asn1/a_verify.c	2
openssl30/crypto/rsa/rsa_ameth.c	3
openssl30/crypto/rsa/rsa_backend.c	2
openssl30/crypto/rsa/rsa_asn1.c	2
openssl30/crypto/asn1/asn_pack.c	1
openssl30/crypto/rsa/rsa_pss.c	3
openssl30/crypto/rsa/rsa_lib.c	4
openssl30/crypto/asn1/a_utctm.c	1
openssl30/crypto/x509/x509cset.c	4
openssl30/crypto/x509/pcy_cache.c	6
openssl30/crypto/x509/pcy_map.c	1
openssl30/crypto/x509/v3_pmaps.c	2
openssl30/crypto/x509/v3_pcons.c	2
openssl30/crypto/x509/pcy_lib.c	1
openssl30/include/internal/dane.h	2
openssl30/crypto/asn1/a_strex.c	9
openssl30/crypto/asn1/a_mbstr.c	7
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/x509/x509_trust.c	5
openssl30/crypto/x509/v3_ncons.c	15
openssl30/crypto/punycode.c	6
openssl30/crypto/x509/v3_asid.c	6
openssl30/crypto/x509/v3_addr.c	10
openssl30/crypto/cmp/cmp_vfy.c	17
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/x509/t_x509.c	5
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/encode_decode/encoder_pkey.c	7
openssl30/crypto/encode_decode/encoder_lib.c	18
openssl30/crypto/x509/v3_prn.c	4
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/x509/x_x509a.c	5
openssl30/crypto/cmp/cmp_status.c	7
openssl30/./e_os.h	1

Fuzzer: asn1parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4596	86.1%
gold	[1:9]	415	7.77%
yellow	[10:29]	30	0.56%
greenyellow	[30:49]	3	0.05%
lawngreen	50+	292	5.47%
All colors	5336	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	12431	15896	CONF_modules_load_file_ex	call site: 00400	/src/openssl30/crypto/conf/conf_mod.c:200
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 05096	/src/openssl/crypto/context.c:294
5603	5603	1 : View List ['ossl_asn1_template_free']	5603	5603	ossl_asn1_item_embed_free	call site: 02493	/src/openssl30/crypto/asn1/tasn_fre.c:48
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04564	/src/openssl30/crypto/conf/conf_mod.c:219
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 00654	/src/openssl111/crypto/bn/bn_shift.c:85
11	11	1 : View List ['lh_ADDED_OBJ_retrieve']	11	19	ossl_obj_obj2nid	call site: 00685	/src/openssl/crypto/objects/obj_dat.c:372
6	3459	2 : View List ['BN_set_negative', 'BN_set_word']	6	3459	BN_sub_word	call site: 00638	/src/openssl111/crypto/bn/bn_word.c:145
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	16573	ossl_crypto_new_ex_data_ex	call site: 00875	/src/openssl30/crypto/ex_data.c:231
0	16552	4 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ASN1_INTEGER_free']	0	16552	ossl_c2i_ASN1_INTEGER	call site: 03815	/src/openssl30/crypto/asn1/a_int.c:306
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	asn1_item_ex_d2i_intern	call site: 03712	/src/openssl30/crypto/asn1/tasn_dec.c:114
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	NCONF_new_ex	call site: 00398	/src/openssl30/crypto/conf/conf_lib.c:190
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	do_init_module_list_lock	call site: 00463	/src/openssl30/crypto/conf/conf_mod.c:102

Runtime coverage analysis

Covered functions

418

Functions that are reachable but not covered

1091

Reachable functions

1483

Percentage of reachable functions covered

26.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/asn1parse.c	1
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	16
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/bio/bio_dump.c	4

Fuzzer: v3name

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4712	88.2%
gold	[1:9]	308	5.76%
yellow	[10:29]	13	0.24%
greenyellow	[30:49]	20	0.37%
lawngreen	50+	288	5.39%
All colors	5341	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	12431	15896	CONF_modules_load_file_ex	call site: 00402	/src/openssl30/crypto/conf/conf_mod.c:200
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04393	/src/openssl30/crypto/conf/conf_mod.c:219
3455	3465	2 : View List ['ASN1_OBJECT_free', 'ERR_put_error']	3455	3465	OBJ_dup	call site: 00726	/src/openssl111/crypto/objects/obj_lib.c:47
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
80	94	3 : View List ['CRYPTO_free', 'CRYPTO_clear_free', 'CRYPTO_secure_clear_free']	80	94	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:45
14	16552	4 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ASN1_INTEGER_free']	14	16552	ossl_c2i_ASN1_INTEGER	call site: 05178	/src/openssl30/crypto/asn1/a_int.c:306
11	11	1 : View List ['lh_ADDED_OBJ_retrieve']	11	19	ossl_obj_obj2nid	call site: 00687	/src/openssl/crypto/objects/obj_dat.c:372
8	16574	8 : View List ['CRYPTO_THREAD_lock_free', 'OPENSSL_die', 'CRYPTO_THREAD_lock_new', 'CRYPTO_UP_REF.2661', 'ERR_set_debug', 'ERR_set_error', 'CRYPTO_DOWN_REF.2660', 'ERR_new']	8	16574	ossl_asn1_do_lock	call site: 02509	/src/openssl30/crypto/asn1/tasn_utl.c:79
2	2	1 : View List ['strlen']	34552	48560	ASN1_mbstring_ncopy	call site: 00000	/src/openssl111/crypto/asn1/a_mbstr.c:54
0	16548	5 : View List ['CRYPTO_free', 'ERR_set_debug', 'ERR_set_error', 'CRYPTO_malloc', 'ERR_new']	0	16548	ossl_asn1_enc_save	call site: 05240	/src/openssl30/crypto/asn1/tasn_utl.c:165
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	asn1_item_ex_d2i_intern	call site: 00006	/src/openssl30/crypto/asn1/tasn_dec.c:114
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	NCONF_new_ex	call site: 00400	/src/openssl30/crypto/conf/conf_lib.c:190

Runtime coverage analysis

Covered functions

375

Functions that are reachable but not covered

1168

Reachable functions

1484

Percentage of reachable functions covered

21.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/v3name.c	1
openssl/crypto/x509/v3_genn.c	6
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	15
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	2
openssl/crypto/asn1/a_type.c	2
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	14
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/x509/x509_cmp.c	1
openssl/crypto/x509/x_name.c	2
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3

Fuzzer: cms_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3124	60.4%
gold	[1:9]	853	16.5%
yellow	[10:29]	79	1.52%
greenyellow	[30:49]	18	0.34%
lawngreen	50+	1092	21.1%
All colors	5166	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44113	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44113	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:854
20741	29759	13 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'DSO_new', 'DSO_merge', 'DSO_free', 'CRYPTO_free', 'get_provider_store', 'DSO_ctrl', 'DSO_load', 'ossl_safe_getenv', 'CRYPTO_strdup', 'DSO_bind_func', 'DSO_convert_filename']	24200	99389	provider_init	call site: 01810	/src/openssl30/crypto/provider_core.c:850
10391	10400	8 : View List ['CRYPTO_zalloc', 'EVP_CIPHER_get_mode', 'OPENSSL_die', 'EVP_CIPHER_CTX_ctrl', 'EVP_CIPHER_get_flags', 'ENGINE_init', 'ENGINE_get_cipher', 'EVP_CIPHER_CTX_get0_cipher']	10391	146179	evp_cipher_init_internal	call site: 03340	/src/openssl30/crypto/evp/evp_enc.c:135
10374	13837	5 : View List ['CRYPTO_zalloc', 'ENGINE_get_digest', 'ENGINE_finish', 'ENGINE_init', 'EVP_PKEY_CTX_ctrl']	10374	68989	evp_md_init_internal	call site: 03285	/src/openssl30/crypto/evp/digest.c:222
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 03822	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
7508	7508	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	7508	24046	evp_md_init_internal	call site: 02686	/src/openssl30/crypto/evp/digest.c:152
5982	9547	2 : View List ['RSA_PSS_PARAMS_free', 'ossl_x509_algor_mgf1_decode']	5982	9547	ossl_rsa_pss_decode	call site: 00000	/src/openssl30/crypto/rsa/rsa_backend.c:455
5736	5740	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	5736	104968	ossl_cipher_generic_block_update	call site: 00000	/src/openssl30/providers/implementations/ciphers/ciphercommon.c:252
5547	5547	1 : View List ['ossl_dh_key2buf']	5547	16795	dh_get_params	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:325
5531	5531	1 : View List ['OSSL_PARAM_BLD_push_BN']	5531	5531	ossl_param_build_set_bn	call site: 00000	/src/openssl30/crypto/param_build_set.c:87

Runtime coverage analysis

Covered functions

2208

Functions that are reachable but not covered

573

Reachable functions

1405

Percentage of reachable functions covered

59.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/cms.c	1
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	45
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	4
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/cms/cms_io.c	2
openssl30/crypto/cms/cms_lib.c	6
openssl30/crypto/cms/cms_asn1.c	1
openssl30/crypto/asn1/a_d2i_fp.c	2
openssl30/crypto/cms/cms_sd.c	3
openssl30/include/openssl/cms.h	2
openssl30/crypto/cms/cms_env.c	4
openssl30/crypto/x509/x_x509.c	1
openssl30/crypto/cms/cms_local.h	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/asn1/a_i2d_fp.c	1
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3

Fuzzer: ct

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4782	87.4%
gold	[1:9]	371	6.78%
yellow	[10:29]	24	0.43%
greenyellow	[30:49]	3	0.05%
lawngreen	50+	286	5.23%
All colors	5466	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 04926	/src/openssl/crypto/context.c:294
5603	5603	1 : View List ['ossl_asn1_template_free']	5603	5603	ossl_asn1_item_embed_free	call site: 02495	/src/openssl30/crypto/asn1/tasn_fre.c:48
3455	3465	3 : View List ['CRYPTO_free', 'ERR_put_error', 'CRYPTO_malloc']	3455	3465	i2o_SCT_signature	call site: 05388	/src/openssl111/crypto/ct/ct_oct.c:176
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	ossl_asn1_time_from_tm	call site: 05325	/src/openssl30/crypto/asn1/a_time.c:285
3455	3455	1 : View List ['ERR_put_error']	3455	3455	SCT_new	call site: 05259	/src/openssl111/crypto/ct/ct_sct.c:26
16	16	1 : View List ['CTLOG_STORE_get0_log_by_id']	18	21134	SCT_print	call site: 05284	/src/openssl111/crypto/ct/ct_prn.c:75
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	16573	ossl_crypto_new_ex_data_ex	call site: 00878	/src/openssl30/crypto/ex_data.c:231
3	3	1 : View List ['is_utc']	3458	6931	ossl_asn1_time_from_tm	call site: 05324	/src/openssl30/crypto/asn1/a_time.c:278
2	2	1 : View List ['CTLOG_get0_name']	2	17623	SCT_print	call site: 05309	/src/openssl111/crypto/ct/ct_prn.c:91
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	asn1_item_ex_d2i_intern	call site: 00007	/src/openssl30/crypto/asn1/tasn_dec.c:114
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	do_init_module_list_lock	call site: 00466	/src/openssl30/crypto/conf/conf_mod.c:102
0	5842	1 : View List ['ossl_provider_store_free']	0	5842	ossl_provider_store_new	call site: 04824	/src/openssl/crypto/provider_core.c:311

Runtime coverage analysis

Covered functions

374

Functions that are reachable but not covered

1166

Reachable functions

1534

Percentage of reachable functions covered

23.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/ct.c	1
openssl/crypto/ct/ct_oct.c	8
openssl/crypto/asn1/tasn_typ.c	14
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	4
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	16
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/include/openssl/ct.h	3
openssl/crypto/ct/ct_sct.c	7
openssl/crypto/bio/bss_null.c	1
openssl/crypto/ct/ct_prn.c	4
openssl/crypto/ct/ct_log.c	2
openssl/crypto/bio/bio_dump.c	1
openssl/crypto/asn1/a_gentm.c	5
openssl/crypto/o_time.c	5
openssl/crypto/asn1/a_time.c	8
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3

Fuzzer: crl

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3798	67.5%
gold	[1:9]	947	16.8%
yellow	[10:29]	77	1.36%
greenyellow	[30:49]	8	0.14%
lawngreen	50+	791	14.0%
All colors	5621	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	12431	15896	CONF_modules_load_file_ex	call site: 00402	/src/openssl30/crypto/conf/conf_mod.c:200
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 04925	/src/openssl/crypto/context.c:294
5521	5521	1 : View List ['parse_oct']	5521	5521	parse_value	call site: 04063	/src/openssl30/crypto/property/property_parse.c:244
5518	5518	1 : View List ['parse_hex']	5518	5518	parse_value	call site: 04055	/src/openssl30/crypto/property/property_parse.c:241
5517	5517	1 : View List ['parse_string']	5517	5517	parse_value	call site: 04045	/src/openssl30/crypto/property/property_parse.c:231
5517	5517	1 : View List ['parse_number']	5517	5517	parse_value	call site: 04068	/src/openssl30/crypto/property/property_parse.c:247
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04393	/src/openssl30/crypto/conf/conf_mod.c:219
3455	3465	2 : View List ['ASN1_OBJECT_free', 'ERR_put_error']	3455	3465	OBJ_dup	call site: 00726	/src/openssl111/crypto/objects/obj_lib.c:47
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	ossl_asn1_time_from_tm	call site: 00000	/src/openssl30/crypto/asn1/a_time.c:285
3455	3455	1 : View List ['ERR_put_error']	3455	3459	bignum_to_string	call site: 00000	/src/openssl111/crypto/x509v3/v3_utl.c:149
3455	3455	1 : View List ['ERR_put_error']	3455	3455	ASN1_item_dup	call site: 00000	/src/openssl111/crypto/asn1/a_dup.c:60
3455	3455	1 : View List ['ERR_put_error']	3455	3455	do_dump	call site: 05359	/src/openssl111/crypto/asn1/a_strex.c:285

Runtime coverage analysis

Covered functions

1341

Functions that are reachable but not covered

685

Reachable functions

1597

Percentage of reachable functions covered

57.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/crl.c	1
openssl/crypto/x509/x_crl.c	4
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	5
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	17
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	17
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	4
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	9
openssl/crypto/objects/obj_xref.h	4
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/x509/t_crl.c	2
openssl/crypto/x509/x509cset.c	10
openssl/crypto/x509/t_x509.c	2
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/asn1/a_strex.c	8
openssl/crypto/x509/x_name.c	1
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/x509/x509name.c	5
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/asn1/a_time.c	6
openssl/crypto/o_time.c	4
openssl/crypto/x509/v3_prn.c	4
openssl/crypto/x509/x509_v3.c	3
openssl/crypto/x509/v3_lib.c	4
openssl/include/openssl/x509v3.h	2
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/asn1/a_print.c	1
openssl/crypto/asn1/f_int.c	1

Fuzzer: pem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4668	88.6%
gold	[1:9]	379	7.20%
yellow	[10:29]	32	0.60%
greenyellow	[30:49]	4	0.07%
lawngreen	50+	180	3.42%
All colors	5263	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 05107	/src/openssl/crypto/context.c:294
3455	3455	1 : View List ['ERR_put_error']	3455	3455	mem_write	call site: 00000	/src/openssl111/crypto/bio/bss_mem.c:227
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
14	14	1 : View List ['bio_call_callback']	3469	3469	bio_read_intern	call site: 02849	/src/openssl111/crypto/bio/bio_lib.c:275
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	16573	ossl_crypto_new_ex_data_ex	call site: 00894	/src/openssl30/crypto/ex_data.c:231
0	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	0	16538	do_init_module_list_lock	call site: 00482	/src/openssl30/crypto/conf/conf_mod.c:102
0	5842	1 : View List ['ossl_provider_store_free']	0	5842	ossl_provider_store_new	call site: 05005	/src/openssl/crypto/provider_core.c:311
0	44	1 : View List ['ossl_property_string_data_free']	0	44	ossl_property_string_data_new	call site: 05018	/src/openssl/crypto/property/property_string.c:111
0	36	1 : View List ['CRYPTO_realloc']	0	38	ERR_vset_error	call site: 00095	/src/openssl30/crypto/err/err_blocks.c:62
0	19	1 : View List ['ossl_threads_ctx_free']	0	19	ossl_threads_ctx_new	call site: 05054	/src/openssl/crypto/thread/internal.c:137
0	4	1 : View List ['CRYPTO_free']	0	4	ossl_prov_conf_ctx_new	call site: 00207	/src/openssl/crypto/provider_conf.c:38
0	4	1 : View List ['CRYPTO_free']	0	4	ossl_crypto_mutex_new	call site: 05053	/src/openssl/crypto/thread/arch/thread_posix.c:102

Runtime coverage analysis

Covered functions

322

Functions that are reachable but not covered

1122

Reachable functions

1420

Percentage of reachable functions covered

20.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/pem.c	1
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/mem.c	7
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2

Fuzzer: punycode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5245	99.3%
gold	[1:9]	2	0.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	32	0.60%
All colors	5279	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	1 : View List ['malloc']	0	0	CRYPTO_malloc	call site: 00002	/src/openssl111/crypto/mem.c:197

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

1388

Reachable functions

1411

Percentage of reachable functions covered

1.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/punycode.c	1
openssl/crypto/mem.c	7
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	14
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	3
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/punycode.c	6
openssl/crypto/packet.c	10

Fuzzer: bndiv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4954	91.5%
gold	[1:9]	257	4.74%
yellow	[10:29]	10	0.18%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	190	3.51%
All colors	5412	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	BN_CTX_new_ex	call site: 00000	/src/openssl30/crypto/bn/bn_ctx.c:122
16538	16538	3 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new']	16538	16538	do_init_module_list_lock	call site: 00482	/src/openssl30/crypto/conf/conf_mod.c:102
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05377	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05253	/src/openssl111/crypto/bn/bn_div.c:224
3453	3453	1 : View List ['BN_set_word']	3453	3453	BN_add	call site: 05377	/src/openssl111/crypto/bn/bn_add.c:29
3453	3453	1 : View List ['BN_set_word']	3453	3453	bn_rshift_fixed_top	call site: 05277	/src/openssl111/crypto/bn/bn_shift.c:186
6	6	1 : View List ['bn_mul_comba4']	6	18	bn_mul_recursive	call site: 05339	/src/openssl111/crypto/bn/bn_mul.c:244
0	3453	1 : View List ['BN_new']	95	7012	bin2bn	call site: 00003	/src/openssl/crypto/bn/bn_lib.c:447
0	0	None	3455	3455	BN_div	call site: 05252	/src/openssl111/crypto/bn/bn_div.c:214
0	0	None	95	3553	bin2bn	call site: 00004	/src/openssl/crypto/bn/bn_lib.c:467
0	0	None	95	3553	bin2bn	call site: 00004	/src/openssl/crypto/bn/bn_lib.c:479
0	0	None	95	3553	bin2bn	call site: 00004	/src/openssl/crypto/bn/bn_lib.c:497

Runtime coverage analysis

Covered functions

218

Functions that are reachable but not covered

1228

Reachable functions

1440

Percentage of reachable functions covered

14.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/bndiv.c	1
openssl/crypto/bn/bn_lib.c	34
openssl/crypto/mem.c	7
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	7
openssl/crypto/bn/bn_shift.c	3
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/bn/bn_div.c	3
openssl/crypto/bn/bn_ctx.c	7
openssl/crypto/bn/bn_mul.c	6
openssl/crypto/bn/bn_add.c	3
openssl/crypto/bn/bn_print.c	2

Fuzzer: smime

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3447	62.1%
gold	[1:9]	898	16.1%
yellow	[10:29]	100	1.80%
greenyellow	[30:49]	28	0.50%
lawngreen	50+	1072	19.3%
All colors	5545	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44115	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44115	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:850
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 00398	/src/openssl30/crypto/conf/conf_mod.c:200
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 05094	/src/openssl/crypto/context.c:294
5521	5521	1 : View List ['parse_oct']	5521	5521	parse_value	call site: 04233	/src/openssl30/crypto/property/property_parse.c:244
5518	5518	1 : View List ['parse_hex']	5518	5518	parse_value	call site: 04225	/src/openssl30/crypto/property/property_parse.c:241
5517	5517	1 : View List ['parse_string']	5517	5517	parse_value	call site: 04215	/src/openssl30/crypto/property/property_parse.c:231
5517	5517	1 : View List ['parse_number']	5517	5517	parse_value	call site: 04238	/src/openssl30/crypto/property/property_parse.c:247
5515	5515	2 : View List ['OSSL_DECODER_get0_name', 'OSSL_DECODER_get0_properties']	5515	27571	ossl_decoder_instance_new	call site: 02301	/src/openssl30/crypto/encode_decode/decoder_lib.c:244
3455	3465	2 : View List ['ASN1_OBJECT_free', 'ERR_put_error']	3455	3465	OBJ_dup	call site: 00722	/src/openssl111/crypto/objects/obj_lib.c:47
3455	3455	1 : View List ['ERR_put_error']	3455	3455	mem_write	call site: 00000	/src/openssl111/crypto/bio/bss_mem.c:227
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 00652	/src/openssl111/crypto/bn/bn_shift.c:85
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 05365	/src/openssl111/crypto/buffer/buffer.c:36

Runtime coverage analysis

Covered functions

1526

Functions that are reachable but not covered

663

Reachable functions

1564

Percentage of reachable functions covered

57.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/smime.c	1
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	15
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	4
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	18
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	3
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	11
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/pkcs7/pk7_mime.c	2
openssl/crypto/pkcs7/pk7_asn1.c	2
openssl/crypto/asn1/asn_mime.c	13
openssl/crypto/asn1/asn1_local.h	14
openssl/include/openssl/bio.h	2
openssl/crypto/evp/bio_b64.c	1
openssl/crypto/asn1/a_d2i_fp.c	2
openssl/crypto/pkcs7/pk7_lib.c	8
openssl/crypto/x509/x_x509.c	1
openssl/include/openssl/pkcs7.h	2
openssl/crypto/x509/x509_cmp.c	3
openssl/crypto/x509/x_name.c	2
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/pkcs7/pk7_attr.c	1
openssl/crypto/pkcs7/pk7_doit.c	2
openssl/crypto/x509/x509_att.c	3
openssl/crypto/asn1/x_algor.c	3

Fuzzer: cms

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3296	61.1%
gold	[1:9]	926	17.1%
yellow	[10:29]	76	1.40%
greenyellow	[30:49]	17	0.31%
lawngreen	50+	1079	20.0%
All colors	5394	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44115	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44115	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:850
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 00419	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 05107	/src/openssl/crypto/context.c:294
5736	5740	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	5736	104968	ossl_cipher_generic_block_update	call site: 00000	/src/openssl30/providers/implementations/ciphers/ciphercommon.c:252
5547	5547	1 : View List ['ossl_dh_key2buf']	5547	16795	dh_get_params	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:325
5525	5525	1 : View List ['OSSL_PARAM_BLD_push_int']	5525	5525	ossl_param_build_set_int	call site: 00000	/src/openssl30/crypto/param_build_set.c:25
5525	5525	1 : View List ['OSSL_PARAM_BLD_push_long']	5525	5525	ossl_param_build_set_long	call site: 00000	/src/openssl30/crypto/param_build_set.c:36
5524	5524	1 : View List ['OSSL_PARAM_BLD_push_utf8_string']	5524	5524	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:47
5523	5523	1 : View List ['OSSL_PARAM_BLD_push_octet_string']	5523	5523	ossl_param_build_set_octet_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:60
5521	5521	1 : View List ['parse_oct']	5521	5521	parse_value	call site: 04246	/src/openssl30/crypto/property/property_parse.c:244

Runtime coverage analysis

Covered functions

2239

Functions that are reachable but not covered

601

Reachable functions

1506

Percentage of reachable functions covered

60.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/cms.c	1
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/mem.c	7
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	39
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	81
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cms/cms_io.c	2
openssl/crypto/cms/cms_lib.c	5
openssl/crypto/cms/cms_asn1.c	1
openssl/crypto/asn1/a_d2i_fp.c	2
openssl/crypto/cms/cms_sd.c	3
openssl/include/openssl/cms.h	2
openssl/crypto/cms/cms_env.c	3
openssl/crypto/x509/x_x509.c	1
openssl/crypto/cms/cms_local.h	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/asn1/a_i2d_fp.c	1
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3

Fuzzer: client_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3290	53.4%
gold	[1:9]	993	16.1%
yellow	[10:29]	120	1.94%
greenyellow	[30:49]	52	0.84%
lawngreen	50+	1705	27.6%
All colors	6160	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44113	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44113	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:854
20741	29759	13 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'DSO_new', 'DSO_merge', 'DSO_free', 'CRYPTO_free', 'get_provider_store', 'DSO_ctrl', 'DSO_load', 'ossl_safe_getenv', 'CRYPTO_strdup', 'DSO_bind_func', 'DSO_convert_filename']	24200	99389	provider_init	call site: 01818	/src/openssl30/crypto/provider_core.c:850
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
13830	13830	3 : View List ['ENGINE_by_id', 'ENGINE_free', 'ENGINE_init']	13830	13830	load_common	call site: 00000	/src/openssl30/providers/common/provider_util.c:71
11085	16654	10 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_freedata', 'evp_keymgmt_util_export', 'evp_keymgmt_util_clear_operation_cache', 'CRYPTO_THREAD_write_lock', 'evp_keymgmt_util_cache_keydata', 'match_type', 'ossl_assert_int.27551', 'evp_keymgmt_util_find_operation_cache']	11085	16654	evp_keymgmt_util_export_to_provider	call site: 02894	/src/openssl30/crypto/evp/keymgmt_lib.c:117
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9649	9655	4 : View List ['EC_GROUP_check', 'EC_KEY_get0_group', 'EC_GROUP_check_named_curve', 'EC_KEY_get_flags']	21192	32963	ec_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ec_kmgmt.c:952
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 03830	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
7508	7508	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	7508	24046	evp_md_init_internal	call site: 02694	/src/openssl30/crypto/evp/digest.c:152
7349	7349	1 : View List ['ecx_key_pairwise_check']	7349	7349	ecx_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ecx_kmgmt.c:768
7347	46282	7 : View List ['RAND_priv_bytes_ex', 'ERR_set_debug', 'ERR_set_error', 'ossl_ecx_key_allocate_privkey', 'ossl_ecx_public_from_private', 'ERR_new', 'ossl_ecx_key_free']	7347	46282	ossl_ecx_key_op	call site: 00000	/src/openssl30/crypto/ec/ecx_backend.c:194

Runtime coverage analysis

Covered functions

3731

Functions that are reachable but not covered

845

Reachable functions

2250

Percentage of reachable functions covered

62.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/client.c	1
openssl30/ssl/methods.c	1
openssl30/ssl/ssl_lib.c	38
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	40
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	20
openssl30/crypto/comp/c_zlib.c	2
openssl30/crypto/async/async.c	17
openssl30/crypto/rand/rand_lib.c	19
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	18
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	44
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	38
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	46
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	18
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	24
openssl30/crypto/evp/keymgmt_meth.c	22
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	11
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	6
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	104
openssl30/crypto/provider.c	4
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	15
openssl30/crypto/evp/p_lib.c	22
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	5
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	5
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	4
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	4
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	7
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	6
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/ssl/ssl_init.c	8
openssl30/ssl/ssl_ciph.c	21
openssl30/include/openssl/ssl.h	5
openssl30/crypto/comp/comp_lib.c	3
openssl30/ssl/s3_lib.c	2
openssl30/ssl/ssl_err.c	1
openssl30/ssl/ssl_cert.c	13
openssl30/ssl/ssl_local.h	6
openssl30/crypto/x509/x509_lu.c	8
openssl30/include/openssl/x509_vfy.h	4
openssl30/crypto/x509/x509_cmp.c	6
openssl30/crypto/x509/x_name.c	3
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/x509/x509_vpm.c	10
openssl30/crypto/ct/ct_log.c	3
openssl30/include/openssl/ct.h	2
openssl30/ssl/tls_depr.c	3
openssl30/ssl/t1_lib.c	4
openssl30/ssl/tls_srp.c	2
openssl30/ssl/ssl_mcnf.c	2
openssl30/ssl/ssl_conf.c	13
openssl30/ssl/ssl_rsa.c	5
openssl30/crypto/x509/x_all.c	1
openssl30/crypto/asn1/a_d2i_fp.c	1
openssl30/ssl/ssl_sess.c	10
openssl30/crypto/x509/x_x509.c	2
openssl30/crypto/x509/x_crl.c	2
openssl30/ssl/statem/extensions_cust.c	4
openssl30/ssl/record/rec_layer_s3.c	6
openssl30/ssl/record/ssl3_record.c	2
openssl30/crypto/x509/x509_set.c	1
openssl30/ssl/statem/statem.c	4
openssl30/ssl/record/ssl3_buffer.c	3
openssl30/ssl/record/rec_layer_d1.c	1
openssl30/ssl/pqueue.c	2
openssl30/ssl/statem/statem_lib.c	1
openssl30/include/internal/dane.h	1
openssl30/crypto/x509/x_exten.c	2
openssl30/include/openssl/ocsp.h	1
openssl30/crypto/ocsp/ocsp_asn.c	2
openssl30/crypto/ct/ct_sct.c	2
openssl30/crypto/async/async_local.h	4
openssl30/crypto/async/arch/async_posix.c	3

Fuzzer: server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3590	52.5%
gold	[1:9]	1099	16.0%
yellow	[10:29]	104	1.52%
greenyellow	[30:49]	50	0.73%
lawngreen	50+	1987	29.0%
All colors	6830	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34547	55366	6 : View List ['ERR_put_error', 'BIO_read', 'ERR_peek_error', 'BUF_MEM_grow_clean', 'ERR_clear_error', 'ASN1_get_object']	34547	55455	asn1_d2i_read_bio	call site: 05906	/src/openssl111/crypto/asn1/a_d2i_fp.c:145
27572	33117	11 : View List ['ossl_ffc_params_set_gindex', 'ossl_dh_new_ex', 'BN_GENCB_set', 'DH_generate_parameters_ex', 'BN_GENCB_new', 'ossl_ffc_params_set_h', 'ossl_ffc_params_set_seed', 'ossl_ffc_params_copy', 'ossl_ffc_set_digest', 'ossl_dh_generate_ffc_parameters', 'ossl_ffc_params_set_pcounter']	27574	36598	dh_gen	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:707
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9649	9655	4 : View List ['EC_GROUP_check', 'EC_KEY_get0_group', 'EC_GROUP_check_named_curve', 'EC_KEY_get_flags']	21192	32963	ec_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ec_kmgmt.c:952
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 00400	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
7301	29797	8 : View List ['ERR_put_error', 'BN_free', 'BN_new', 'BN_mod_exp', 'int_bn_mod_inverse', 'BN_priv_rand_range', 'bn_to_mont_fixed_top', 'BN_dup']	7301	29900	BN_BLINDING_create_param	call site: 00000	/src/openssl111/crypto/bn/bn_blind.c:255
6939	43665	6 : View List ['ossl_param_build_set_int', 'EC_GROUP_get_basis_type', 'ossl_param_build_set_utf8_string', 'EC_GROUP_get_degree', 'EC_GROUP_get_pentanomial_basis', 'EC_GROUP_get_trinomial_basis']	6939	43665	ec_get_ecm_params	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ec_kmgmt.c:595
6073	6073	1 : View List ['d2i_PUBKEY_ex']	6073	33413	d2i_SSL_SESSION_ex	call site: 00000	/src/openssl/ssl/ssl_asn1.c:341
6011	6011	1 : View List ['ossl_ec_key_pairwise_check']	6011	6117	ec_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ec_kmgmt.c:972
5880	22428	8 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'sk_nid_triple_value', 'sk_nid_triple_find', 'obj_sig_init', 'ERR_set_debug', 'ERR_set_error', 'ERR_new']	5880	22428	ossl_obj_find_sigid_algs	call site: 05566	/src/openssl/crypto/objects/obj_xref.c:78

Runtime coverage analysis

Covered functions

3895

Functions that are reachable but not covered

859

Reachable functions

2477

Percentage of reachable functions covered

65.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/server.c	1
openssl/ssl/methods.c	1
openssl/ssl/ssl_lib.c	35
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	22
openssl/crypto/comp/c_zlib.c	2
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	17
openssl/crypto/async/arch/async_posix.c	5
openssl/crypto/rand/rand_lib.c	20
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	17
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	31
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	29
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	15
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	7
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	39
openssl/crypto/provider_core.c	51
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	19
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	51
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	11
openssl/crypto/asn1/a_octet.c	2
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	5
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	103
openssl/crypto/rsa/rsa_ossl.c	2
openssl/crypto/dsa/dsa_ossl.c	2
openssl/crypto/ec/ec_kmeth.c	2
openssl/crypto/dh/dh_key.c	2
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	3
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	19
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	2
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	23
openssl/crypto/provider.c	4
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	16
openssl/crypto/evp/p_lib.c	32
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	6
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	11
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	5
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	4
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	6
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	18
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	12
openssl/crypto/objects/obj_xref.h	7
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/ssl/ssl_init.c	8
openssl/ssl/ssl_ciph.c	22
openssl/include/openssl/ssl.h	5
openssl/crypto/comp/comp_lib.c	2
openssl/ssl/s3_lib.c	2
openssl/ssl/ssl_err.c	1
openssl/ssl/ssl_cert.c	14
openssl/ssl/quic/../ssl_local.h	5
openssl/crypto/x509/x509_lu.c	7
openssl/include/openssl/x509_vfy.h	4
openssl/crypto/x509/x509_cmp.c	9
openssl/crypto/x509/x_name.c	7
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/x509/x509_vpm.c	3
openssl/crypto/ct/ct_log.c	3
openssl/include/openssl/ct.h	1
openssl/ssl/tls_depr.c	3
openssl/ssl/t1_lib.c	17
openssl/ssl/tls_srp.c	2
openssl/ssl/ssl_mcnf.c	2
openssl/ssl/ssl_conf.c	13
openssl/ssl/ssl_rsa.c	7
openssl/crypto/x509/x_all.c	2
openssl/crypto/asn1/a_d2i_fp.c	1
openssl/ssl/ssl_sess.c	9
openssl/include/internal/time.h	2
openssl/ssl/ssl_local.h	4
openssl/crypto/x509/x_x509.c	3
openssl/crypto/x509/t_x509.c	1
openssl/crypto/x509/x_crl.c	2
openssl/ssl/statem/extensions_cust.c	1
openssl/ssl/statem/statem_lib.c	1
openssl/crypto/rsa/rsa_asn1.c	2
openssl/crypto/ec/ec_key.c	4
openssl/crypto/ec/ec_lib.c	4
openssl/crypto/rsa/rsa_backend.c	1
openssl/crypto/rsa/rsa_lib.c	1
openssl/crypto/ec/ec_backend.c	1
openssl/crypto/dsa/dsa_backend.c	1
openssl/crypto/dsa/dsa_lib.c	2
openssl/crypto/dh/dh_backend.c	1
openssl/crypto/dh/dh_lib.c	1
openssl/crypto/x509/v3_purp.c	12
openssl/crypto/asn1/a_digest.c	1
openssl/crypto/x509/x509_set.c	6
openssl/crypto/x509/x509_ext.c	4
openssl/crypto/x509/v3_lib.c	6
openssl/crypto/x509/x509_v3.c	7
openssl/include/openssl/x509v3.h	6
openssl/crypto/x509/v3_bcons.c	2
openssl/crypto/x509/v3_pcia.c	2
openssl/crypto/x509/v3_crld.c	1
openssl/crypto/asn1/a_dup.c	1
openssl/crypto/x509/x509name.c	1
openssl/crypto/pem/pem_all.c	4
openssl/crypto/evp/p_legacy.c	2
openssl/crypto/ec/ecp_nistz256.c	1
openssl/crypto/ec/ecp_nistp224.c	1
openssl/crypto/ec/ecp_nistp256.c	1
openssl/crypto/ec/ecp_nistp521.c	1
openssl/crypto/ec/ec_mult.c	1
openssl/crypto/bn/bn_mont.c	1
openssl/crypto/pem/pem_x509.c	1
openssl/crypto/pem/pem_oth.c	1
openssl/crypto/ffc/ffc_params.c	2
openssl/ssl/statem/statem.c	7
openssl/ssl/record/rec_layer_s3.c	5
openssl/ssl/s3_msg.c	1
openssl/ssl/tls13_enc.c	1
openssl/ssl/t1_enc.c	1
openssl/crypto/bio/bss_dgram_pair.c	1
openssl/ssl/pqueue.c	1
openssl/crypto/async/async_local.h	4

Fuzzer: server_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3405	51.2%
gold	[1:9]	994	14.9%
yellow	[10:29]	125	1.88%
greenyellow	[30:49]	54	0.81%
lawngreen	50+	2066	31.0%
All colors	6644	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34547	55366	6 : View List ['ERR_put_error', 'BIO_read', 'ERR_peek_error', 'BUF_MEM_grow_clean', 'ERR_clear_error', 'ASN1_get_object']	34547	55455	asn1_d2i_read_bio	call site: 05581	/src/openssl111/crypto/asn1/a_d2i_fp.c:145
27572	33117	11 : View List ['ossl_ffc_params_set_gindex', 'ossl_dh_new_ex', 'BN_GENCB_set', 'DH_generate_parameters_ex', 'BN_GENCB_new', 'ossl_ffc_params_set_h', 'ossl_ffc_params_set_seed', 'ossl_ffc_params_copy', 'ossl_ffc_set_digest', 'ossl_dh_generate_ffc_parameters', 'ossl_ffc_params_set_pcounter']	27574	36598	dh_gen	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:707
20741	29759	13 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'DSO_new', 'DSO_merge', 'DSO_free', 'CRYPTO_free', 'get_provider_store', 'DSO_ctrl', 'DSO_load', 'ossl_safe_getenv', 'CRYPTO_strdup', 'DSO_bind_func', 'DSO_convert_filename']	24200	99389	provider_init	call site: 01818	/src/openssl30/crypto/provider_core.c:850
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
17183	37286	7 : View List ['ossl_rsa_sync_to_pss_params_30', 'ossl_rsa_set0_pss_params', 'RSA_PSS_PARAMS_free', 'ERR_set_debug', 'ERR_set_error', 'ossl_rsa_pss_decode', 'ERR_new']	17183	37286	ossl_rsa_param_decode	call site: 00000	/src/openssl30/crypto/rsa/rsa_backend.c:542
13830	13830	3 : View List ['ENGINE_by_id', 'ENGINE_free', 'ENGINE_init']	13830	13830	load_common	call site: 00000	/src/openssl30/providers/common/provider_util.c:71
11166	11170	7 : View List ['ossl_rsa_pss_params_30_set_maskgenhashalg', 'ossl_rsa_pss_params_30_set_hashalg', 'ossl_rsa_pss_params_30_set_defaults', 'ossl_rsa_pss_params_30_todata', 'ossl_rsa_pss_get_param_unverified', 'EVP_MD_get_type', 'ossl_rsa_pss_params_30_set_saltlen']	11166	16841	rsa_int_export_to	call site: 00000	/src/openssl30/crypto/rsa/rsa_ameth.c:793
10501	13975	3 : View List ['PROXY_CERT_INFO_EXTENSION_free', 'X509_get_ext_by_NID', 'ASN1_INTEGER_get']	10501	111187	ossl_x509v3_cache_extensions	call site: 05965	/src/openssl30/crypto/x509/v3_purp.c:454
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9790	86784	22 : View List ['BN_CTX_start', 'EC_GROUP_set_point_conversion_form', 'BN_num_bits', 'EC_GROUP_set_seed', 'EC_POINT_oct2point', 'EC_GROUP_set_asn1_flag', 'EC_GROUP_set_generator', 'OSSL_PARAM_get_BN', 'ec_group_explicit_to_named', 'BN_CTX_new_ex', 'EC_GROUP_new_curve_GF2m', 'OPENSSL_strcasecmp', 'EC_POINT_free', 'BN_CTX_get', 'EC_POINT_new', 'BN_is_negative', 'EC_GROUP_get_degree', 'EC_GROUP_new_curve_GFp', 'ossl_ec_encoding_param2id', 'BN_CTX_free', 'BN_is_zero', 'BN_CTX_end']	9790	417942	EC_GROUP_new_from_params	call site: 00000	/src/openssl30/crypto/ec/ec_lib.c:1558
9649	9655	4 : View List ['EC_GROUP_check', 'EC_KEY_get0_group', 'EC_GROUP_check_named_curve', 'EC_KEY_get_flags']	21192	32963	ec_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ec_kmgmt.c:952
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 03830	/src/openssl30/crypto/conf/conf_mod.c:200

Runtime coverage analysis

Covered functions

3730

Functions that are reachable but not covered

849

Reachable functions

2408

Percentage of reachable functions covered

64.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/server.c	1
openssl30/ssl/methods.c	1
openssl30/ssl/ssl_lib.c	43
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	40
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	20
openssl30/crypto/comp/c_zlib.c	2
openssl30/crypto/async/async.c	17
openssl30/crypto/rand/rand_lib.c	19
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	18
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	44
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	39
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	2
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	2
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	2
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	2
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	46
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	18
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	3
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	19
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	2
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	24
openssl30/crypto/evp/keymgmt_meth.c	23
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	11
openssl30/crypto/asn1/asn1_lib.c	13
openssl30/crypto/asn1/a_octet.c	2
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	6
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	24
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	104
openssl30/crypto/provider.c	4
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	16
openssl30/crypto/evp/p_lib.c	34
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	8
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	11
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	5
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	4
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	4
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	7
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	6
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	5
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/ssl/ssl_init.c	8
openssl30/ssl/ssl_ciph.c	21
openssl30/include/openssl/ssl.h	5
openssl30/crypto/comp/comp_lib.c	3
openssl30/ssl/s3_lib.c	2
openssl30/ssl/ssl_err.c	1
openssl30/ssl/ssl_cert.c	15
openssl30/ssl/ssl_local.h	9
openssl30/crypto/x509/x509_lu.c	8
openssl30/include/openssl/x509_vfy.h	4
openssl30/crypto/x509/x509_cmp.c	9
openssl30/crypto/x509/x_name.c	7
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/x509/x509_vpm.c	10
openssl30/crypto/ct/ct_log.c	3
openssl30/include/openssl/ct.h	2
openssl30/ssl/tls_depr.c	3
openssl30/ssl/t1_lib.c	13
openssl30/ssl/tls_srp.c	2
openssl30/ssl/ssl_mcnf.c	2
openssl30/ssl/ssl_conf.c	13
openssl30/ssl/ssl_rsa.c	7
openssl30/crypto/x509/x_all.c	2
openssl30/crypto/asn1/a_d2i_fp.c	1
openssl30/ssl/ssl_sess.c	10
openssl30/crypto/x509/x_x509.c	3
openssl30/crypto/x509/x_crl.c	2
openssl30/ssl/statem/extensions_cust.c	4
openssl30/ssl/statem/statem_lib.c	1
openssl30/crypto/rsa/rsa_asn1.c	2
openssl30/crypto/ec/ec_key.c	4
openssl30/crypto/ec/ec_lib.c	4
openssl30/crypto/rsa/rsa_backend.c	1
openssl30/crypto/rsa/rsa_lib.c	1
openssl30/crypto/ec/ec_backend.c	1
openssl30/crypto/dsa/dsa_backend.c	1
openssl30/crypto/dsa/dsa_lib.c	3
openssl30/crypto/dh/dh_backend.c	1
openssl30/crypto/dh/dh_lib.c	1
openssl30/crypto/x509/v3_purp.c	12
openssl30/crypto/asn1/a_digest.c	1
openssl30/crypto/x509/x509_set.c	6
openssl30/crypto/x509/x509_ext.c	4
openssl30/crypto/x509/v3_lib.c	6
openssl30/crypto/x509/x509_v3.c	5
openssl30/include/openssl/x509v3.h	6
openssl30/crypto/x509/v3_bcons.c	2
openssl30/crypto/x509/v3_pcia.c	2
openssl30/crypto/x509/v3_crld.c	1
openssl30/crypto/asn1/a_dup.c	1
openssl30/crypto/x509/x509name.c	1
openssl30/crypto/pem/pem_all.c	4
openssl30/crypto/evp/p_legacy.c	2
openssl30/crypto/ec/ecp_nistz256.c	1
openssl30/crypto/ec/ecp_nistp224.c	1
openssl30/crypto/ec/ecp_nistp256.c	1
openssl30/crypto/ec/ecp_nistp521.c	1
openssl30/crypto/ec/ec_mult.c	1
openssl30/crypto/bn/bn_mont.c	1
openssl30/crypto/pem/pem_x509.c	1
openssl30/crypto/pem/pem_oth.c	1
openssl30/crypto/ffc/ffc_params.c	2
openssl30/ssl/record/rec_layer_s3.c	6
openssl30/ssl/record/ssl3_record.c	2
openssl30/ssl/statem/statem.c	5
openssl30/ssl/record/ssl3_buffer.c	3
openssl30/ssl/record/rec_layer_d1.c	1
openssl30/ssl/pqueue.c	2
openssl30/include/internal/dane.h	1
openssl30/crypto/x509/x_exten.c	2
openssl30/include/openssl/ocsp.h	1
openssl30/crypto/ocsp/ocsp_asn.c	2
openssl30/crypto/ct/ct_sct.c	2
openssl30/crypto/async/async_local.h	4
openssl30/crypto/async/arch/async_posix.c	3

Fuzzer: asn1_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3789	50.6%
gold	[1:9]	975	13.0%
yellow	[10:29]	121	1.61%
greenyellow	[30:49]	42	0.56%
lawngreen	50+	2547	34.0%
All colors	7474	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20741	29759	13 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'DSO_new', 'DSO_merge', 'DSO_free', 'CRYPTO_free', 'get_provider_store', 'DSO_ctrl', 'DSO_load', 'ossl_safe_getenv', 'CRYPTO_strdup', 'DSO_bind_func', 'DSO_convert_filename']	24200	99389	provider_init	call site: 01818	/src/openssl30/crypto/provider_core.c:850
10374	13837	5 : View List ['CRYPTO_zalloc', 'ENGINE_get_digest', 'ENGINE_finish', 'ENGINE_init', 'EVP_PKEY_CTX_ctrl']	10374	68989	evp_md_init_internal	call site: 03293	/src/openssl30/crypto/evp/digest.c:222
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 06176	/src/openssl111/crypto/ec/ec_oct.c:113
9116	9138	4 : View List ['UI_destroy_method', 'OPENSSL_cleanse', 'do_ui_passphrase', 'CRYPTO_clear_realloc']	9116	25676	ossl_pw_get_passphrase	call site: 02449	/src/openssl30/crypto/passphrase.c:280
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 03638	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 06187	/src/openssl111/crypto/ec/ec_oct.c:32
7508	7508	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	7508	24046	evp_md_init_internal	call site: 02694	/src/openssl30/crypto/evp/digest.c:152
7095	7095	1 : View List ['key_to_epki_der_priv_bio']	7095	7095	key_to_pki_der_priv_bio	call site: 00000	/src/openssl30/providers/implementations/encode_decode/encode_key2any.c:253
5982	9547	2 : View List ['RSA_PSS_PARAMS_free', 'ossl_x509_algor_mgf1_decode']	5982	9547	ossl_rsa_pss_decode	call site: 00000	/src/openssl30/crypto/rsa/rsa_backend.c:455
5594	5594	1 : View List ['UI_UTIL_wrap_read_pem_callback']	14710	64346	ossl_pw_get_passphrase	call site: 02410	/src/openssl30/crypto/passphrase.c:263
5547	5547	1 : View List ['ossl_dh_key2buf']	5547	16795	dh_get_params	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:325
5531	5531	1 : View List ['OSSL_PARAM_BLD_push_BN']	5531	5531	ossl_param_build_set_bn	call site: 00000	/src/openssl30/crypto/param_build_set.c:87

Runtime coverage analysis

Covered functions

2935

Functions that are reachable but not covered

740

Reachable functions

2301

Percentage of reachable functions covered

67.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/asn1.c	1
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	30
openssl30/crypto/init.c	40
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	4
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	17
openssl30/crypto/comp/c_zlib.c	2
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	19
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	22
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	16
openssl30/include/internal/cryptlib.h	7
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	24
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	34
openssl30/crypto/getenv.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	38
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	3
openssl30/crypto/engine/tb_eckey.c	6
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	5
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	46
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	17
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/passphrase.c	10
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	17
openssl30/crypto/encode_decode/decoder_lib.c	24
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	20
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	19
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	42
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	6
openssl30/crypto/bn/bn_conv.c	5
openssl30/include/internal/constant_time.h	6
openssl30/crypto/bn/asm/x86_64-gcc.c	10
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/include/openssl/core_dispatch.h	96
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	10
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	24
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	4
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	12
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	6
openssl30/crypto/evp/evp_pkey.c	2
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	5
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	10
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	6
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	18
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	3
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/asn1/tasn_prn.c	9
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/asn1/a_utctm.c	1
openssl30/crypto/asn1/a_time.c	6
openssl30/crypto/o_time.c	4
openssl30/crypto/asn1/a_gentm.c	1
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/asn1/a_strex.c	6
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/ts/ts_asn1.c	12
openssl30/crypto/ts/ts_req_print.c	1
openssl30/crypto/ts/ts_req_utils.c	2
openssl30/crypto/ts/ts_lib.c	5
openssl30/crypto/x509/x509_v3.c	5
openssl30/crypto/x509/v3_prn.c	3
openssl30/crypto/x509/v3_lib.c	4
openssl30/include/openssl/x509v3.h	2
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/ts/ts_rsp_print.c	5
openssl30/crypto/x509/v3_san.c	1
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/ess/ess_asn1.c	10
openssl30/crypto/dh/dh_asn1.c	5
openssl30/crypto/dh/dh_lib.c	6
openssl30/crypto/ffc/ffc_params.c	6
openssl30/crypto/dh/dh_group_params.c	1
openssl30/crypto/ffc/ffc_dh.c	4
openssl30/crypto/dsa/dsa_sign.c	3
openssl30/crypto/asn1_dsa.c	3
openssl30/include/internal/packet.h	14
openssl30/crypto/dsa/dsa_asn1.c	6
openssl30/crypto/dsa/dsa_lib.c	1
openssl30/crypto/rsa/rsa_asn1.c	4
openssl30/crypto/rsa/rsa_lib.c	1
openssl30/crypto/rsa/rsa_local.h	1
openssl30/crypto/rsa/rsa_mp.c	2
openssl30/crypto/bn/bn_blind.c	1
openssl30/crypto/ec/ec_asn1.c	14
openssl30/crypto/ec/ec_curve.c	6
openssl30/crypto/ec/ec_lib.c	36
openssl30/crypto/bn/bn_ctx.c	15
openssl30/crypto/ec/ec_cvt.c	2
openssl30/crypto/ec/ecp_mont.c	1
openssl30/crypto/ec/ecp_nistz256.c	2
openssl30/crypto/ec/ecp_nistp224.c	2
openssl30/crypto/ec/ecp_nistp256.c	2
openssl30/crypto/ec/ecp_nistp521.c	2
openssl30/crypto/ec/ec_mult.c	2
openssl30/crypto/bn/bn_mont.c	11
openssl30/crypto/ec/ec2_smpl.c	1
openssl30/crypto/ec/ec_local.h	1
openssl30/crypto/bn/bn_add.c	4
openssl30/crypto/bn/bn_div.c	3
openssl30/crypto/bn/bn_gcd.c	3
openssl30/crypto/bn/bn_mod.c	7
openssl30/crypto/bn/bn_mul.c	6
openssl30/crypto/ec/ec_oct.c	4
openssl30/crypto/ec/ecp_oct.c	3
openssl30/crypto/bn/bn_sqr.c	4
openssl30/crypto/bn/bn_sqrt.c	1
openssl30/crypto/bn/bn_exp.c	8
openssl30/crypto/bn/rsaz_exp.c	2
openssl30/crypto/bn/rsaz_exp.h	2
openssl30/crypto/bn/bn_recp.c	6
openssl30/crypto/bn/bn_rand.c	2
openssl30/crypto/bn/bn_kron.c	1
openssl30/crypto/ec/ec2_oct.c	3
openssl30/crypto/bn/bn_gf2m.c	7
openssl30/crypto/ec/eck_prn.c	2
openssl30/crypto/evp/ec_support.c	1
openssl30/crypto/asn1/t_pkey.c	2
openssl30/crypto/bn/bn_intern.c	1
openssl30/crypto/ec/ec_key.c	11
openssl30/crypto/ec/ec_ameth.c	3
openssl30/crypto/encode_decode/encoder_pkey.c	7
openssl30/crypto/encode_decode/encoder_lib.c	18
openssl30/crypto/asn1/i2d_evp.c	2
openssl30/ssl/ssl_asn1.c	5
openssl30/ssl/ssl_sess.c	3
openssl30/ssl/ssl_init.c	8
openssl30/ssl/ssl_ciph.c	10
openssl30/include/openssl/ssl.h	3
openssl30/crypto/comp/comp_lib.c	2
openssl30/ssl/s3_lib.c	3
openssl30/ssl/ssl_err.c	1
openssl30/ssl/ssl_lib.c	8
openssl30/crypto/x509/x_x509.c	2
openssl30/ssl/ssl_txt.c	1
openssl30/ssl/tls_depr.c	1
openssl30/crypto/x509/x509_txt.c	1

Fuzzer: client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3498	55.0%
gold	[1:9]	1098	17.2%
yellow	[10:29]	98	1.54%
greenyellow	[30:49]	49	0.77%
lawngreen	50+	1614	25.3%
All colors	6357	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
44111	44115	8 : View List ['RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.31191', 'sk_BIGNUM_const_push', 'RSA_get0_p', 'RSA_get0_q', 'RSA_get0_iqmp']	44111	44115	ossl_rsa_get0_all_params	call site: 00000	/src/openssl30/crypto/rsa/rsa_lib.c:850
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
11630	11630	1 : View List ['X509_STORE_CTX_init_rpk']	11634	78288	ssl_verify_internal	call site: 00000	/src/openssl/ssl/ssl_cert.c:452
11085	16654	10 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_freedata', 'evp_keymgmt_util_export', 'evp_keymgmt_util_clear_operation_cache', 'CRYPTO_THREAD_write_lock', 'evp_keymgmt_util_cache_keydata', 'match_type', 'ossl_assert_int.27551', 'evp_keymgmt_util_find_operation_cache']	11085	16654	evp_keymgmt_util_export_to_provider	call site: 03112	/src/openssl30/crypto/evp/keymgmt_lib.c:117
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9649	9655	4 : View List ['EC_GROUP_check', 'EC_KEY_get0_group', 'EC_GROUP_check_named_curve', 'EC_KEY_get_flags']	21192	32963	ec_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ec_kmgmt.c:952
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 00400	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
6115	6119	2 : View List ['OSSL_PARAM_construct_uint32', 'ossl_get_max_early_data']	6119	93424	ssl_set_new_record_layer	call site: 06223	/src/openssl/ssl/record/rec_layer_s3.c:1295
6011	6011	1 : View List ['ossl_ec_key_pairwise_check']	6011	6117	ec_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/ec_kmgmt.c:972
5975	5975	1 : View List ['ossl_dh_check_pairwise']	5975	5975	dh_validate	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:435
5847	5847	1 : View List ['tls_do_uncompress']	5847	56445	tls_default_post_process_record	call site: 00000	/src/openssl/ssl/record/methods/tls_common.c:1042

Runtime coverage analysis

Covered functions

3879

Functions that are reachable but not covered

859

Reachable functions

2324

Percentage of reachable functions covered

63.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/client.c	1
openssl/ssl/methods.c	1
openssl/ssl/ssl_lib.c	31
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	22
openssl/crypto/comp/c_zlib.c	2
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	17
openssl/crypto/async/arch/async_posix.c	5
openssl/crypto/rand/rand_lib.c	20
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	17
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	31
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	28
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	6
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	38
openssl/crypto/provider_core.c	51
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	51
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	11
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/crypto/async/async_wait.c	5
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	103
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	18
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	22
openssl/crypto/provider.c	4
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	5
openssl/crypto/evp/keymgmt_lib.c	15
openssl/crypto/evp/p_lib.c	22
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	3
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	5
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	4
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	6
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	18
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	11
openssl/crypto/objects/obj_xref.h	7
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/ssl/ssl_init.c	8
openssl/ssl/ssl_ciph.c	22
openssl/include/openssl/ssl.h	5
openssl/crypto/comp/comp_lib.c	2
openssl/ssl/s3_lib.c	2
openssl/ssl/ssl_err.c	1
openssl/ssl/ssl_cert.c	12
openssl/ssl/quic/../ssl_local.h	2
openssl/crypto/x509/x509_lu.c	7
openssl/include/openssl/x509_vfy.h	4
openssl/crypto/x509/x509_cmp.c	6
openssl/crypto/x509/x_name.c	3
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/x509/x509_vpm.c	3
openssl/crypto/ct/ct_log.c	3
openssl/include/openssl/ct.h	1
openssl/ssl/tls_depr.c	3
openssl/ssl/t1_lib.c	7
openssl/ssl/tls_srp.c	2
openssl/ssl/ssl_mcnf.c	2
openssl/ssl/ssl_conf.c	13
openssl/ssl/ssl_rsa.c	5
openssl/crypto/x509/x_all.c	1
openssl/crypto/asn1/a_d2i_fp.c	1
openssl/ssl/ssl_sess.c	9
openssl/include/internal/time.h	2
openssl/ssl/ssl_local.h	4
openssl/crypto/x509/x_x509.c	2
openssl/crypto/x509/t_x509.c	1
openssl/crypto/x509/x_crl.c	2
openssl/ssl/statem/extensions_cust.c	1
openssl/ssl/statem/statem.c	6
openssl/ssl/statem/statem_lib.c	1
openssl/ssl/record/rec_layer_s3.c	5
openssl/ssl/s3_msg.c	1
openssl/ssl/tls13_enc.c	1
openssl/ssl/t1_enc.c	1
openssl/crypto/bio/bss_dgram_pair.c	1
openssl/ssl/pqueue.c	1
openssl/crypto/async/async_local.h	4

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3793	49.2%
gold	[1:9]	1119	14.5%
yellow	[10:29]	135	1.75%
greenyellow	[30:49]	39	0.50%
lawngreen	50+	2609	33.9%
All colors	7695	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9914	9914	2 : View List ['ec_GFp_simple_oct2point', 'ec_GF2m_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 06377	/src/openssl111/crypto/ec/ec_oct.c:113
8974	8974	2 : View List ['CONF_modules_load', 'conf_diagnostics']	8974	15896	CONF_modules_load_file_ex	call site: 00400	/src/openssl30/crypto/conf/conf_mod.c:200
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 06388	/src/openssl111/crypto/ec/ec_oct.c:32
7095	7095	1 : View List ['key_to_epki_der_priv_bio']	7095	7095	key_to_pki_der_priv_bio	call site: 00000	/src/openssl30/providers/implementations/encode_decode/encode_key2any.c:253
5840	5840	1 : View List ['ossl_rand_crng_ctx_free']	5840	5870	context_deinit_objs	call site: 04923	/src/openssl/crypto/context.c:294
5595	5595	1 : View List ['ossl_DER_w_precompiled']	5595	5595	DER_w_MaskGenAlgorithm	call site: 00000	/src/openssl30/providers/common/der/der_rsa_key.c:269
5547	5547	1 : View List ['ossl_dh_key2buf']	5547	16795	dh_get_params	call site: 00000	/src/openssl30/providers/implementations/keymgmt/dh_kmgmt.c:325
5528	5528	1 : View List ['OSSL_PARAM_BLD_push_BN_pad']	5528	5528	ossl_param_build_set_bn_pad	call site: 00000	/src/openssl30/crypto/param_build_set.c:72
5525	5525	1 : View List ['OSSL_PARAM_BLD_push_int']	5525	5525	ossl_param_build_set_int	call site: 00000	/src/openssl30/crypto/param_build_set.c:25
5525	5525	1 : View List ['OSSL_PARAM_BLD_push_long']	5525	5525	ossl_param_build_set_long	call site: 00000	/src/openssl30/crypto/param_build_set.c:36
5524	5524	1 : View List ['OSSL_PARAM_BLD_push_utf8_string']	5524	5524	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:47
5523	5523	1 : View List ['OSSL_PARAM_BLD_push_octet_string']	5523	5523	ossl_param_build_set_octet_string	call site: 00000	/src/openssl30/crypto/param_build_set.c:60

Runtime coverage analysis

Covered functions

3039

Functions that are reachable but not covered

759

Reachable functions

2431

Percentage of reachable functions covered

68.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/asn1.c	1
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	28
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	7
openssl/crypto/threads_pthread.c	14
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	2
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	20
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	19
openssl/include/internal/refcount.h	2
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	9
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	15
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/err/err_all.c	1
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	31
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	17
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	34
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	4
openssl/crypto/err/err_mark.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	47
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	10
openssl/crypto/bn/bn_shift.c	6
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	10
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	6
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	6
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	38
openssl/crypto/provider_core.c	50
openssl/crypto/dso/dso_lib.c	9
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	25
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_dyn.c	12
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	49
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	19
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	27
openssl/engines/e_afalg_err.c	3
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/eng_local.h	11
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	5
openssl/crypto/engine/tb_eckey.c	6
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/bn/bn_conv.c	5
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	95
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	3
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	17
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	10
openssl/crypto/encode_decode/decoder_pkey.c	14
openssl/crypto/encode_decode/decoder_meth.c	20
openssl/crypto/encode_decode/decoder_lib.c	23
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	10
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	24
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	4
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	12
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/asn1/p8_pkey.c	6
openssl/crypto/evp/evp_pkey.c	2
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	5
openssl/crypto/x509/x_pubkey.c	8
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	18
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	18
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	3
openssl/crypto/bio/bss_null.c	1
openssl/crypto/asn1/tasn_prn.c	9
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/a_utctm.c	1
openssl/crypto/asn1/a_time.c	6
openssl/crypto/o_time.c	4
openssl/crypto/asn1/a_gentm.c	1
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/asn1/a_strex.c	6
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/ts/ts_asn1.c	12
openssl/crypto/ts/ts_req_print.c	1
openssl/crypto/ts/ts_req_utils.c	2
openssl/crypto/ts/ts_lib.c	5
openssl/crypto/x509/x509_v3.c	5
openssl/crypto/x509/v3_prn.c	3
openssl/crypto/x509/v3_lib.c	4
openssl/include/openssl/x509v3.h	2
openssl/crypto/asn1/a_print.c	1
openssl/crypto/ts/ts_rsp_print.c	5
openssl/crypto/x509/v3_san.c	1
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/ess/ess_asn1.c	10
openssl/crypto/dh/dh_asn1.c	5
openssl/crypto/dh/dh_lib.c	6
openssl/crypto/ffc/ffc_params.c	6
openssl/crypto/dh/dh_group_params.c	1
openssl/crypto/ffc/ffc_dh.c	4
openssl/crypto/dsa/dsa_sign.c	3
openssl/crypto/asn1_dsa.c	3
openssl/include/internal/packet.h	14
openssl/crypto/dsa/dsa_asn1.c	6
openssl/crypto/dsa/dsa_lib.c	1
openssl/crypto/rsa/rsa_asn1.c	4
openssl/crypto/rsa/rsa_lib.c	1
openssl/crypto/rsa/rsa_local.h	1
openssl/crypto/rsa/rsa_mp.c	2
openssl/crypto/bn/bn_blind.c	1
openssl/crypto/ec/ec_asn1.c	14
openssl/crypto/ec/ec_curve.c	6
openssl/crypto/ec/ec_lib.c	36
openssl/crypto/bn/bn_ctx.c	15
openssl/crypto/ec/ec_cvt.c	2
openssl/crypto/ec/ecp_mont.c	1
openssl/crypto/ec/ecp_nistz256.c	2
openssl/crypto/ec/ecp_nistp224.c	2
openssl/crypto/ec/ecp_nistp256.c	2
openssl/crypto/ec/ecp_nistp521.c	2
openssl/crypto/ec/ec_mult.c	2
openssl/crypto/bn/bn_mont.c	11
openssl/crypto/ec/ec2_smpl.c	1
openssl/crypto/ec/ec_local.h	1
openssl/crypto/bn/bn_add.c	4
openssl/crypto/bn/bn_div.c	3
openssl/crypto/bn/bn_gcd.c	3
openssl/crypto/bn/bn_mod.c	7
openssl/crypto/bn/bn_mul.c	6
openssl/crypto/ec/ec_oct.c	4
openssl/crypto/ec/ecp_oct.c	3
openssl/crypto/bn/bn_sqr.c	4
openssl/crypto/bn/bn_sqrt.c	1
openssl/crypto/bn/bn_exp.c	8
openssl/crypto/bn/rsaz_exp.c	2
openssl/crypto/bn/rsaz_exp.h	2
openssl/include/internal/constant_time.h	6
openssl/crypto/bn/bn_recp.c	6
openssl/crypto/bn/bn_rand.c	2
openssl/crypto/bn/bn_kron.c	1
openssl/crypto/ec/ec2_oct.c	3
openssl/crypto/bn/bn_gf2m.c	7
openssl/crypto/ec/eck_prn.c	2
openssl/crypto/evp/ec_support.c	1
openssl/crypto/asn1/t_pkey.c	2
openssl/crypto/bn/bn_intern.c	1
openssl/crypto/ec/ec_key.c	11
openssl/crypto/ec/ec_ameth.c	3
openssl/crypto/encode_decode/encoder_pkey.c	7
openssl/crypto/encode_decode/encoder_lib.c	19
openssl/crypto/asn1/i2d_evp.c	2
openssl/ssl/ssl_asn1.c	6
openssl/ssl/ssl_sess.c	3
openssl/ssl/ssl_init.c	8
openssl/ssl/ssl_ciph.c	10
openssl/include/openssl/ssl.h	3
openssl/crypto/comp/comp_lib.c	2
openssl/ssl/s3_lib.c	3
openssl/ssl/ssl_err.c	1
openssl/include/internal/time.h	9
openssl/crypto/time.c	1
openssl/ssl/ssl_lib.c	8
openssl/crypto/x509/x_x509.c	2
openssl/crypto/x509/t_x509.c	1
openssl/ssl/ssl_txt.c	1
openssl/ssl/tls_depr.c	1
openssl/crypto/x509/x509_txt.c	1